RFC: SELinux model