On: If your code accepts URIs as input, filter out “fi...

[pawadu]

configuring SELinux is way too complicated for the average user.

[nerdponx → pawadu]

And poorly documented. I learned what little I know about it from online tutorials, not the docs

[zanny → pawadu]

Then use one of the nowadays many alternatives - there is Apparmor, Tomoyo, and GRSec's RBAC all performing the same MAC job.