[fhars]

Yes, having to always explicitly specify all the fine grained capabilities a process might need is a pain, too.

[jeroenhd]

With Ubuntu's AppArmor you can run a lot of software without hassle because the ACLs come with the OS package.