Why SELinux is more work, but well worth the trouble