Why not both?

In the docker world, it would be a huge improvement.

The problem is that the docker policy is RHEL/Fedora centric and is not upstreamed in the refpolicy AFAIK

We're touching on the limits of my understanding. Could you please elaborate?

SELinux is made of 3 things

- The kernel doing the permissions check (called object manager) - The policy telling the kernel what is allowed or not - Some userspace tools and libraries to load and manipulate the policy and the state of SELinux

The kernel and the userspace tools are almost the same across all distributions (Well Fedora/RHEL are carrying some patches).

But for the policy it's a different story. RHEL/Fedora have a gigantic patch applied to the refpolicy (reference policy developed by the SELinux upstream).

The policy allowing docker to work has not been upstreamed so it's not that easy for other distributions to use it