Ensuring an SELinux rule is never allowed