I mean SElinux plus cgroups is probably good enough. Although as soon as it talks to the desktop environment all bets are off.

In my personal opinion, SELinux is a rather poor design, and I find that it actively gets in the way of trying to do security well.