I wish I could set up SELinux but NixOS doesn’t support it… I already do something similar where all files on root are wiped by default (E: on each boot) and I have to opt things into persistence so it’s definitely something that I’d like.