Is it really so? I get an impression that SELinux is a so complicated that nobody wants to bother with setting it up and everyone disables it as soon as possible.
Ubuntu runs AppArmor in its version of enforcing mode. I've only ever run into issues with it once though, so I presume it is a similarly lax policy.
[0] The policy is called "targeted", to reflect the fact that you are supposed to write targeted policy modules for specific applications you are concerned about.
Last time while I was migrating a DNS server, our zone folders were not in a standard path, and Bind was unable to find them. 10 minutes later I remembered about AppArmor, and moved the files.
The only problematic hardening was Thunderbird, which broke attachments. They disabled the Thunderbird’s profile after failing to fix it.
Currently I’m on mobile, so I can’t give you a list of active profiles, yet the list is not short and the policy is not lax.
I worked with both of them back in the day and developed profiles for them.
Update: Stats are as follows:
78 packages ship AppArmor profiles in Debian 12. Notable are:
- mariadb-server
- redshift (f.lux alternative)
- bind
- ioquake3 (yes, the game)
- squid
- tcpdump
among others.
So, AppArmor ecosystem is neither lax, nor unmaintained.
SELinux is complicated, but it's not impossible to work with. Configuring new rules is another story, though.
However, there is a large scale exception to this: Android. Android uses SELinux extensively, and it is also used as part of further sandboxes in Chrome and Android System Intelligence.