The AppArmor patches have been largely upstreamed by Canonical, and improvements continue to float upstream constantly. So claiming it's not being reviewed isn't accurate.
> * Canonical doesn't know how to work with SELinux at all, and doesn't want to learn how to
That's disingenuous. Canonical works with many parties, and has people working on LSM stacking for example precisely to support co-existence of the systems. We also had exchanges in the forum to discuss the implementation of actual backends in snapd to support it, but Canonical indeed won't pay for the cost of implementation until there's a reason to do it. That's business as usual and pretty straightforward.
> In addition, the majority of snaps are not sandboxed at all anyway, as they operate in "classic" confinement.
That's incorrect by a huge margin. I'm curious about where you could possibly have based that opinion on? Classic snaps require manual reviews, which need to be backed by public justification. You can see every single request floating by in the store category at https://forum.snapcraft.io. That means every snap people push without talking to anyone are not classic, and thus the vast majority.
> Finally, Canonical is the sole arbiter of snaps.
Well, yes, it has created the project and maintains it actively for years now. You're welcome as a contributor.
> Disclaimer: I'm a Linux app developer that grudgingly deals with both formats. I'd rather just keep using RPMs myself
And I work on snapd (and have also worked on RPM back then, so enjoy :).
