hardened Gentoo SELinux policy for java