@aral I did read the articles. In embedded we also use selinux to lock everything down even more.