Debian ships with AppArmor as the default MAC framework.
sudo apt install apparmor apparmor-utils apparmor-profiles apparmor-profiles-extra
sudo systemctl enable --now apparmor
sudo aa-status
List known profiles and their mode:
sudo aa-status
ls -la /etc/apparmor.d
Put critical services into enforce mode (examples):
sudo aa-enforce /etc/apparmor.d/usr.sbin.cupsd 2>/dev/null || true
sudo aa-enforce /etc/apparmor.d/usr.sbin.nginx 2>/dev/null || true
SELinux is available on Debian, but it is typically more complex to operate than AppArmor. Use it only if you have a clear requirement and operational experience.