I accidentally found out that apparmor is disabled by default with the liquorix kernel.
I was not aware of this and was wondering if this is a bug or feature.

in the liquorix config:

CONFIG_LSM="lockdown,yama,bpf"

To get apparmor working I now use the extra boot parameter in grub:

lsm=landlock,lockdown,yama,apparmor,bpf
Back to top

This is intentional, the Liquorix build is reused by Arch, Debian, Ubuntu, and soon Fedora. Each distribution has its own LSM preferences that are incompatible with the others.

The best solution is to provide a simple global set that is an overlap of all of them and let you override as needed.
Back to top

I never noticed. Is this documented somewhere?
What are the risks of a disabled apparmor? As i understood, you don't have a sandbox for your browsers anymore.
Back to top

I did some research and it looks completely safe to add apparmor in, even if it's not installed or disabled. Next release will have apparmor enabled by default if eligible.
Back to top

Nice! Thanks!
Back to top