On Tue, Nov 28, 2017 at 08:22:50PM -0800, Russ Allbery wrote:
Maybe SELinux would be better, but various people have been trying to make SELinux better-integrated with Debian for quite some time, and those efforts don't seem to have been particularly successful.
Well, maybe it should just be turned on by default, then all the remaining issues will magically go away just like they will for apparmor!
Ubuntu has successfully shipped with AppArmor enabled.
For all the packages in debian? Cool! That will save a lot of work. Mike Stone