enable AppArmor by default

[adrelanos]

Technically, add apparmor=1 security=apparmor to kernelopts.

qvm-prefs -s vmname kernelopts "nopat apparmor=1 security=apparmor"

For Debian templates I don't foresee any issues. For Whonix templates I foresee even less issues. Other templates, no idea.

What is the plan regarding 'VM kernel by default'?
(I am not advocating either dom0 or VM kernel. Just asking.)

[adrelanos]

In case this is a no or inconclusive I would back up to a separate ticket enable AppArmor by default for Qubes-Whonix.

---

For Whonix it's sane to enable AppArmor by default since we don't ship AppArmor profiles by default which have potential to break in bad ways. (Such as for Tor Browser which has its own updater so Tor Browser might rush ahead and do things which are not covered by apparmor-profile-torbrowser.) We only ship AppArmor profiles for packages which are upgraded through Debian apt package management which undergo testing before flowing into the stable repository (such as for Tor, sdwdate, ...).

AppArmor enabled by default in Non-Qubes-Whonix for many releases.

Package https://github.com/Whonix/grub-enable-apparmor only works when using VM kernel.

Related:

• https://www.whonix.org/wiki/AppArmor
• https://www.whonix.org/wiki/Template:Qubes_AppArmor

[adrelanos]

In case this is a no or inconclusive I would back up to a separate ticket enable AppArmor by default for Qubes-Whonix.

---

For Whonix it's sane to enable AppArmor by default since we don't ship AppArmor profiles by default which have potential to break in bad ways. (Such as for Tor Browser which has its own updater so Tor Browser might rush ahead and do things which are not covered by apparmor-profile-torbrowser.) We only ship AppArmor profiles for packages which are upgraded through Debian apt package management which undergo testing before flowing into the stable repository (such as for Tor, sdwdate, ...).

AppArmor enabled by default in Non-Qubes-Whonix for many releases.

Package https://github.com/Whonix/grub-enable-apparmor only works when using VM kernel.

Related:

• https://www.whonix.org/wiki/AppArmor
• https://www.whonix.org/wiki/Template:Qubes_AppArmor

[marmarek]

What is the plan regarding 'VM kernel by default'?

For now it is blocked by being incompatible with PVH :/

[marmarek]

What is the plan regarding 'VM kernel by default'?

For now it is blocked by being incompatible with PVH :/

[lunarthegrey]

AppArmor works good in my PVH VMs, been using it for a while now. I don't think it's installed by default in the Debian template if I can remember correctly.

[lunarthegrey]

AppArmor works good in my PVH VMs, been using it for a while now. I don't think it's installed by default in the Debian template if I can remember correctly.