hardened Gentoo SELinux policy for cdrecord