I think that both AppArmor and SELinux are unusable in practice due to lack of better tools for generating those configurations. There needs to be better graph

I think that both AppArmor and SELinux are unusable in practice due to lack of better tools for generating those configurations. There needs to be better graphical tools for this, like a "profiler" or similar that watches a process for a specific time for errors in the config and that incrementally adds features while the process is running. In my opinion, systemd sandboxes are where it's at. [1] They are seccomp based sandboxes, but have a lot of isolation and sandboxing features that are very easy to use, and they can also be incrementally enhanced with both SELinux and AppArmor profiles. [1] "man systemd.exec" or https://manpages.ubuntu.com/manpages/bionic/man5/systemd.exec.5.html https://manpages.ubuntu.com/manpages/bionic/man5/systemd.exe...