Open GvY85 opened 5 years ago
@GvY85 Many thanks for your report.
DietPi is no fully fledged Debian Buster, but it comes very lightweight, so that you need to install certain features, like AppArmor, manually. But that should be easy via APT and we might consider to add it to DietPi-Software as well, since some things need to be adjusted, to e.g allowing a symlink for MariaDB database files to dietpi_userdata for easier external drive transfer.
Aha, so it is a deliberate thing. Good to know. Then perhaps indeed it would be nice to add it to Dietpi-Software. It seems like a nice feature
On the other hand: since it is automatically turned on on a regular or minimal Buster and seem lightweight perhaps it should be default on with Dietpi as well? To not skimp on security?
To collect some info: https://packages.debian.org/buster/apparmor-utils
I am still not 100% sure about doubled features with systemd access and security settings. Once can limit access to certain general or special directories, on file-access basis via run user anyway and limit kernel/device capabilities as well. So at first we will ship it as optional install only, marked as experimental/beta to allow intensive testing with out software installs, before shipping it as fully DietPi compatible. Only if there is any real benefit (security-wise) over simply using stricter systemd unit settings, we might implement it as regular part of DietPi images.
I will add it to the v6.27 milestone, as we need to get the already delayed v6.26 release ready.
Not sure if I'm missing something obvious:
# apt install -y apparmor apparmor-profiles apparmor-utils apparmor-profiles-extra
# aa-status
apparmor module is loaded.
apparmor filesystem is not mounted.
Mount message persists after reboot.
Tried a random guess but it didn't work:
cat > boot.conf <<EOF
BOOT_UART=0
WAKE_ON_GPIO=1
POWER_OFF_ON_HALT=0
APPARMOR=1
SECURITY=apparmor
EOF
rpi-eeprom-config --apply boot.conf
reboot
Creating a bug report/issue
Required Information
Additional Information (if applicable)
Steps to reproduce
Migrate from Stretch to Buster by updating sources and running apt-get update && apt-get upgrade && apt-get dist-upgrade
Expected behaviour
You should end up with a full fletched Buster install with all new features such as AppArmor enabled?
Actual behaviour
It seems that if i upgrade from an excisting Dietpi Stretch installation to Buster I dont get Buster features like AppArmor installed/enabled by default like it should with Buster? Is this on purpose or a bug? And what happens when or do I need to install a fresh Buster using https://dietpi.com/downloads/images/DietPi_NativePC-UEFU-x86_64-Buster.7z?
So main question is if a fresh install or migrate give different results and how to get a Dietpi Buster with features like AppArmor etc enabled