The distributed development model makes it tricky, because distributions themselves aren't necessarily the developers of sandboxing solutions, there's multiple approaches, many are incompatible with each other, none are fully mature and support every tool users could realistically want to run.
Same with selinux/apparmor/competitors, they're all mutually exclusive to some degree and have different pros and cons. RHEL shoves selinux down everyone's throat without caring how well that works in practice, and coincidentally 100% of RHEL systems I've interacted with have it disabled.
Until there's solutions that are mature, the best solution for distros is still to let users choose the lesser evil for their specific use case.
Comments
The distributed development model makes it tricky, because distributions themselves aren't necessarily the developers of sandboxing solutions, there's multiple approaches, many are incompatible with each other, none are fully mature and support every tool users could realistically want to run.
Same with selinux/apparmor/competitors, they're all mutually exclusive to some degree and have different pros and cons. RHEL shoves selinux down everyone's throat without caring how well that works in practice, and coincidentally 100% of RHEL systems I've interacted with have it disabled.
Until there's solutions that are mature, the best solution for distros is still to let users choose the lesser evil for their specific use case.