Modifications are limited to policy-based access control over standard operations (unlike OpenWall)

Requires modified utilities and applications to use full functionality, but is configurable by policy - I have written policy to provide significant security benefits with no application changes