Does active SELinux (as used in Red Hat derivatives) limit the damage at all?

I built some rhel7 systems that are relaying user-provided LDAP credentials into a domain controller, and these are probably wide open with these flaws.

I would hope that SELinux would prevent the launch of a shell, at least.

Does PHP built with FORTIFY_SOURCE and other RedHat-recommended compiler flags help?