@GossiTheDog True, but #SELinux to restrict #php execution is difficult to implement.

For instance, when using #Apache and #php-fpm, the latter has the same SEL profile as the main apache process and therefore, none of the restrictions of the SEL profile used for PHP scripts. Creating a custom SEL profile for php-fpm is not something you can improvise in half a day.