BlueKey

In some usecases SELinux is less flexible:

You have two applications installed which bring their own labels and rules, lets say app_a_t and app_b_t. Now you want to give AppA read access to only one specific directory of AppB data (which is labeled app_b_t).

How to do that? Writing a rule allowing acces between the labels would give AppA access to all of AppB data. Creating a new label for this specific dir would break AppB as it relies on the rules for app_b_t.

My biggest issue with SELinux is that files and applications can not have multiple types at once (like with a role based model).

A hill to die on: AppAmor is better for most user setups.