Disabling SELinux's runtime disable

The thing I personally do not like about SELinux is actually that some distros use SELinux, some use AppArmor, some use neither and if you want to use any sort of config management generated configuration that works on all of them you suddenly have to adjust the pointless differences between distros (e.g. different usernames or paths or config file names) in three or more places (in the actual config and in the policies) instead of just one.

If you forget (or don't know) about adjusting it in one SELinux policy you suddenly have to figure out why your configuration that works perfectly fine on a sane distro doesn't work on "distro that likes to use SELinux but also ancient versions for everything", either because some config option you use isn't supported on that distro or because SELinux blocks it which is often hard to distinguish because the C return code system doesn't give you some proper "blocked by SELinux" error but just some numeric error code that the majority of applications which don't explicitly handle SELinux errors probably logs (if you are lucky) as a generic permission denied or file not found,... error, often without even referencing the operation it tried to perform or the object it tried to perform it on.