> The problem with AppArmor and friends is that they are hell on earth to configure and manage. > I don't mind spending little time to lock-down my systems a b

> The problem with AppArmor and friends is that they are hell on earth to configure and manage. > I don't mind spending little time to lock-down my systems a bit, but writing new AppArmor rules is about as attractive as bashing my head against the proverbial brick wall. Yep. This is one of the prime motivators as to why OpenBSD did what they did. Often times, when AppArmor and similar solutions prevent a program from working properly, the first reaction is to disable it, and then these protections tend to stay disabled.