Default mode for apparmor profiles : complain or enforce ?

[Ivan Krstić]

Mathias Gug wrote:
> So to avoid the same fiasco, I thought about shipping all profiles in
> complain mode at first. Once profiles have been more tested, they could
> be installed in enforce mode by default.

That's absolutely the way to do it; shipping with enforce enabled from
day one _will_ break the user experience in unpredictable ways and anger
or exasperate people.

-- 
Ivan Krstić <krstic at solarsail.hcs.harvard.edu>