Apparmor is easier to understand, learn and use. Selinux is definitely more powerful but the learning curve is so deep. It is not just the security model that i

Apparmor is easier to understand, learn and use. Selinux is definitely more powerful but the learning curve is so deep. It is not just the security model that is complex. The documentation surrounding it isn’t that good, and avc logging is not enabled by default (you need to install some package) so when something goes wrong I always struggle to figure out how to debug it. Finally, there’s also this library of existing selinux settings provided by the operating system that you need to integrate with. That one is largely undocumented, and what little documentation exists is scattered.heck it took me a week just to find its source code (hint: it is separated in two different repos, not obvious st all). In contrast, apparmor made sense and worked the first time I used it. So yeah, selinux is more powerful, but by being so difficult to use it encourages people to go ‘hey something is broken, fsck this I’ll disable selinux’.