I've never been tempted by AppArmor because SELinux is awesome. The learning curve is brutal, but when it works, it's beautiful. You configure a targeted poli

I've never been tempted by AppArmor because SELinux is awesome. The learning curve is brutal, but when it works, it's beautiful. You configure a targeted policy for a daemon, and that policy describes all of the reasonable behaviour profiles for the daemon. Files and directories are assigned contexts referenced by the policies. If it attempts to write to a directory that isn't part of its normal context, permission denied. Open an abnormal socket? denied. Abnormal IPC? denied.