How should secrets be handled for SELinux and AppArmor?

// Example of storing secrets in a secure way
$secrets = [
    'DB_USERNAME' => getenv('DB_USERNAME'),
    'DB_PASSWORD' => getenv('DB_PASSWORD'),
];

// Utilize SELinux or AppArmor policies to restrict access to these secrets
setsebool('httpd_can_network_connect_db', on);  // For SELinux
// or 
apparmor_parser -r /etc/apparmor.d/usr.sbin.nginx;  // For AppArmor to reload the policy after update

// Application logic...
function connectToDatabase($username, $password) {
    // Connection code using secrets
}
connectToDatabase($secrets['DB_USERNAME'], $secrets['DB_PASSWORD']);