When CentOS 7 came out, I decided to make peace with all of the new stuff (systemd) and all of the old stuff I had been disabling (SELinux.)<p>Turns out that doing crazy shit like letting users have their html files in ~/public_html/ requires a lot of SELinux configuration. procmail touching user directories? Yep. spamassassin? Why, yes. Maybe there's something I did wrong... I did read the docs.<p>Also turns out that there isn't a tool which tells you what new rules are needed, relative to the existing configuration, for recent SELinux denies. Yeah, there are some tools to spit out a complete config file based on all logged problems, but not a diff, and I had already lost some of the early logs to logrotate n=4 by the time I realized I needed 'em.<p>111 lines of perl and 116 lines of SELinux rules later, I was in good shape. But REALLY? REALLY?