staticassertion 3 days ago

SELinux and Apparmor are typically configured by admins. They require root privileges and are designed with human interfaces. It is certainly atypical for a program to say "hey kernel, apply this apparmor profile to me" and they're not designed for incrementally dropping rights either.

On Windows and MacOS programs are free to sandbox themselves programmatically and without privileges. Linux is the odd one out, basically every way of reducing your privileges programmatically requires already being root or at least having an admin preconfigure the system in a way that would allow it.

baq 3 days ago

Which both are so hard to get correctly that everyone on the desktop disables them. Ergonomics matter.

  • preisschild 3 days ago

    Thats not true. Fedora has SELinux enabled by default and I dont have issues with it.