@lanodan honestly, that's how mandatory access control should work imo

default to not allowing, only allow explicitly allowed files

and i don't know why selinux or apparmor are not like this (probably for simplicity?)