[blockoperation]

It must be used with care though, otherwise you'll end up with so many holes in your policy that you defeat whole point of using SELinux in the first place. Definitely don't use the output directly.

[snuxoll]

Certainly not, but it's a great first step.