Isn't SELinux turned on by default in most mainstream distros these days? I think it's not "nightmarishly difficult" as it is "nightmarishly difficult" to use with the most complicated scenarios you can come up with but the system will let you be as permissive or restrictive as you like. I really wish more would be invested in making SELinux more convenient because it appears to me to be the best solution when dealing with virus', malware and so on.