http://www.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion/w/index.php?title=Sandbox-app-launcher&action=edit
.
* Block any dangerous or unused [https://man7.org/linux/man-pages/man2/ioctl.2.html ioctls] such as TIOCSTI (can be used in sandbox escapes), TIOCSETD (can increase kernel attack surface by loading vulnerable line disciplines), SIOCGIFHWADDR (can retrieve the user’s MAC address), etc.
* Implement [https://en.wikipedia.org/wiki/W%5EX W^X] (explained in detail further below).
Apparmor also gives fine-grained controls over IPC signals, D-Bus, UNIX sockets, ptrace and more