Apparmor has a nice learning curve, it's easy to get started with: sudo apt install apparmor-utils sudo aa-genprof /path/to/app Profiles are saved in

Apparmor has a nice learning curve, it's easy to get started with: sudo apt install apparmor-utils sudo aa-genprof /path/to/app Profiles are saved in /etc/apparmor.d/ Many apps need access to /dev/urandom, /usr/bin, /usr/lib and be able to send and receive hup and int signals from other programs. One nice thing is that you can define rules for child process spawned by your executable: /path/to/your/app/childprocessorscripts/** Cx -> scripts, profile scripts { ... } Unix sockets are very nice, prefer them over TCP/IP. For example if you have Nginx or other proxy, use Unix sockets instead of TCP/IP! network unix, Unix sockets allows you to set permissions per socket If your app needs to spawn something that use TCP: /usr/bin/curl px -> networkTool, profile networkTool { network, } Permission errors will show up in /var/log/kern.log You can find errors and edit profiles with aa-logprof If you get frustrated you can allow everything, but show logs: sudo aa-complain /path/to/app