Debian has apparmor-profiles but it’s too immature to enforce by default.