This is what SELinux provides though, is the thing. What we've really messed up on with desktop is not getting this to a state where it's reasonably manageable.