Unsupported system - AppArmor issues

[corgan2222]

First, thanks a lot for this detailed guide! The installation worked perfectly fine.

But in HW, there is an appamor warning

Unsupported system - AppArmor issues

System is unsupported because AppArmor is working incorrectly and add-ons are running in an unprotected and insecure way. Use the link to learn more and how to fix this.

I have this in my /boot/firmware/config.txt

[all]

usb_max_current_enable=1

apparmor=1 security=apparmor
kernel=kernel8.img

true, because apparmor was loaded but not mounted.

I had to enter

apparmor=1 security=apparmor

at the end of my /boot/firmware/cmdline.txt

Now everything works fine.

greetz Stefan

[HuckleberryLovesYou]

First of all: Thanks for your great feedback! Feedback overall is highly appreciated! If there is anything, even if it's just bad formatting, please contact me!

Now to what you've mentioned: I've noticed that Warn in HA, but I thought "Hm... Maybe it's just because I'm using an unofficial installation.". I didn't figure the way out completely on my own. I watched a few Videos and did hour long searches on Google trying to find a way to set this up. In a Video, I found the person just said to put those lines in the config.txt-File and was done after that. Seems like he wasn't right.

It's amazing that you were also able to give me a way to fix this issue! I couldn't reproduce a warn so I guess it worked. I'm going to edit the readme.md! But before I can, could you please provide me with the following information: You said you put in apparmor=1 security=apparmor in the cmdline.txt, but does that mean, you removed it from the config.txt?

and

Were there any kind of issue caused by that? # that would be great to know for the troubleshooting section

I would interpret that as having the line above in both files is required. Thanks again for your issue!

[corgan2222]

np, I hope this helps. I had to search for hours and was not even sure, that this will work. Sadly, the HA guys saying, that a Raspbian OS 12 is not OK for a HA supervisor installation.

Debian Linux Debian 12 aka Bookworm (no derivatives) https://github.com/home-assistant/architecture/blob/master/adr/0014-home-assistant-supervised.md

But I used the basic Raspberry Pi OS 64bit, a port of Debian 12 Bookworm from the Pi Imager and with the help of your instruction, it works. Maybe you can add this info to your instruction.

Yes I removed apparmor=1 security=apparmor from the config.txt and have it only in the cmdline.txt.

Source:

• https://www.tenable.com/audits/items/CIS_Debian_Linux_7_v1.0.0_L2.audit:6a75c0a6bc9eb805cd4d53839a726318
• https://github.com/Kanga-Who/home-assistant/issues/25

gz Stefan

[HuckleberryLovesYou]

Thanks for your quick reply! I changed the Readme! I'm not sure now what is really needed in cmdline and config, so I just wrote to put the text into both of them. Thanks for your help!

[corgan2222]

one additional note

if you get log messages like:

level=error msg="add cg to OOM monitor" error="cgroups: memory cgroup not supported on this system"

fix it by adding "cgroup_memory=1" and "cgroup_enable=memory" in /boot/firmware/cmdline.txt & reboot.

my /boot/firmware/cmdline.txt now looks like this: console=serial0,115200 console=tty1 root=PARTUUID=aff5abda-02 rootfstype=ext4 fsck.repair=yes rootwait quiet splash plymouth.ignore-serial-consoles cfg80211.ieee80211_regdom=DE systemd.unified_cgroup_hierarchy=false apparmor=1 security=apparmor cgroup_enable=memory cgroup_memory=1

sources:

• https://www.gerbenvanadrichem.com/infrastructure/docker-on-raspbian-cgroup-not-supported-on-this-system/
• https://github.com/moby/moby/issues/35587#issuecomment-346895060

[HuckleberryLovesYou]

Thank you for your additional note and for sharing your cmdline.txt As it might be helpful for some people, I decided it would be good to create a new issue #9 issue out of that.

[hiteshsharma]

Thanks for sharing this. This helped fix the issue. This should go in official HA docs