With SELinux developed by NSA and AppArmor by Novell [*], what alternate solutions exists when trying to lock down a system and running applications, based on ACL and similar concepts like Zones on Solaris.
with applications i mean: services that are available and public accessible via network, namely all kinds of web/applicationservers, but also db-servers.
chroot is not an option, because its PITA to setup and maintain in the long run (experiences).
What i want to achieve: limit access of netbased services to its config- and datafiles only (docroot for webservers, dbs for db-server etc); outgoing connections are managed via firewall and service-proxies. if some attacker is able to access the system, he7she shall be limited on what to see and what to do, e.g. dont run programs, dont read other files.
[*] because of gag-orders and such, no trust anymore.