> I see tools like AppArmor as band-aids to fix problems that shouldn't exist in the first place. I fundamentally disagree on that. I think tools like that are

> I see tools like AppArmor as band-aids to fix problems that shouldn't exist in the first place. I fundamentally disagree on that. I think tools like that are amazing at protecting against unknown threats/exploits. They let you lock down software and protect against future unknown exploits, badly behaving software, malicious employees etc. I think something similar should be a part of any OS claiming to be security focused. Basic DAC is woefully insufficient. On the other hand, the industry has largely found other solutions like sandboxing, but I still think MAC or RBAC or whichever has a place, certainly as art of a defense in depth strategy.