I believe that for the OpenBSD developers, SELinux/apparmor/seccmp are against their philosophy. [0] While they are very powerful tools, they require complex r

I believe that for the OpenBSD developers, SELinux/apparmor/seccmp are against their philosophy. [0] While they are very powerful tools, they require complex rules maintained outside the actual code, and their complexity may lead you to disable the Security stuff entirely, rather than try to re-write the rules your distro/package came with. OpenBSD had systrace back in the day to restrict system calls, but it suffered from the Time of Check/Time of Use/ problem, and was only used on one (sshd) program in the base system. [0] https://www.openbsd.org/papers/hackfest2015-pledge/ https://www.openbsd.org/papers/hackfest2015-pledge/