Access control is a good idea, sandboxing on top of it is saying its too nuanced a problem so heres a kitchen sink of overhead. Linux has had some of the best

Access control is a good idea, sandboxing on top of it is saying its too nuanced a problem so heres a kitchen sink of overhead. Linux has had some of the best software security through MAC (SELinux, Apparmor) and cgroups. The problem is that there is no culture in free software to actually write specifications at the point of development, it generally falls on distros / maintainers to try to sort out MAC profiles or cgroups restrictions on a per-package basis. That is why the packagers largely went with the Snap / Flatpak route of saying screw doing the grunt work heres a total sandbox with all the libraries built in. It would be great if we could convince the whole ecosystem to start provisioning access specifications for libraries and binaries so upstream could start building apparmor / selinux profiles from provided files rather than having to do learning mode auditing that drove distro maintainers to not even bother.