The difference between SELinux policies and the systemd security settings for locking down a service is about integration and where they are maintained. The SEL

The difference between SELinux policies and the systemd security settings for locking down a service is about integration and where they are maintained. The SELinux policies are not integrated well with the applications and normally the apps don't think about shipping their own SELinux policy tweaks. With systemd security settings this is much different because the app normally provides the systemd service file and the security settings are part of it and maintained by the app developers. Edit: With AppArmor it's similar and the app devs normally don't think about providing an AppArmor profile but I think it's at least a bit easier than with SELinux policies.