Just go with the SELinux enabled, it doesn't break anything but adds plenty of security features.
By default, all network processes are sandboxed, it also can sandbox desktop apps as well.
Basically working with SELinux is easy, for example:
- When you enable SELinux, filesystem has to be relabeled during boot, it is possible to relabel folders online as well, this is because files are not labeled when it's off
- There are "booleans", they can boost your security a lot, you can disable "ptrace" for example or access to /proc and /sys for all non-root users
- You can fix issues if any with custom applications by using "audit2allow" with the audit.log
- you can use
sandbox command to sandbox scripts
- there are GUI tools in Fedora to manage SELinux policies
There are two things which are very beneficial:
- sandboxed processes will not be able to read and write files if someone manages to inject code
- it may prevent some kernel exploits from working especially if you harden it via "booleans". Kernel exploit would normally bypass SELinux.
There are also other security features in Linux like Capabilities, ACLs, cgroups.