Comment 6 for bug 236510

The quote from Falko Timme that was referenced earlier is this:

Falco Timme> "In my opinion you don't need it [AppArmor] to configure a secure system, and it usually causes more problems than advantages (think of it after you have done a week of trouble-shooting because some service wasn't working as expected, and then you find out that everything was ok, only AppArmor was causing the problem)."

I'm a sysadmin and I agree with him 100%.

To Juergen, who said "Ah, come on, it's not that hard to configure apparmor...", I'd like to point out that your post suggests that all Ubuntu Server users should be forced to fully understand all of:

sys_chroot
aa-logprof
/etc/apparmor.d/usr.sbin.named
aa-complain
aa-enforce
/etc/apparmor.d/force-complain (and the "enforce flag")

As a sysadmin who actually has to meet production schedules, if I'm given the two options:

a) Learn some big, complicated security system that some dude at Canonical thinks is really great
-vs-
b) /etc/init.d/apparmor stop

...which do you think I'll choose?

I also find it ironic that AppArmor -- a supposed security layer -- is preventing him from running bind in a chroot, which is a long-established security practice.