This is good advice! I’ve heard many engineers bemoan setting up SELinux policies however they’ll dump a non-trivial amount of time into security theatre.