kicksecure / apparmor-profile-everything Goto Github PK

Hi. It is that time of the year. I wrote a full system AppArmor policy for Debian, since this does not seem to work anymore. I restricted it a lot (I guess). Combining with other profiles I ported from another project, it now functions. And by functions, I mean without breaking stuff. The base policy is relatively strict, and most sensitive root processes are covered in their respective profiles. I normally wanted to use this repo as a base but turns out licenses are not compatible with the other project. Anyway, I would like to merge the projects to bring this one back to life. This is important because there being a big name like Whonix behind a project makes all the difference for popularity and user trust. Else my project will just be some random abandonware in some years (or maybe not, but chances). Maybe the two can be rebased, license changed, or in some other way merged together. I am willing to do anything to help, if the maintainers are interested. If not, you can just close the issue.

When applying the package from the Whonix repo onto a fresh installation of Debian 10 (on both an AWS EC2 and a local VMWare Workstation VM) I lose the ability to reboot.

I originally found this when using the 5.10 kernel from buster-backports and I tested also on the stock 4.19 kernel and it is reproducible there also.

If I issue the reboot command the OS gets stuck on a blinking cursor and does not reboot. When setting systemd to complain using aa-complain systemd this issue goes away.

Unable to see any logging in auditd relating to this.

@adrelanos & @madaidan ,

Would you consider releasing AppArmor profiles under something that is compatible with Apache-2.0? I'd love to include the pre-built *.deb into savchenko/debian as the user-selectable option, but it turns out that licenses have only one-way compatibility:

However, GPLv3 software cannot be included in Apache projects. The licenses are incompatible in one direction only, and it is a result of ASF's licensing philosophy and the GPLv3 authors' interpretation of copyright law.

Reference

I keep getting this error E: Problem executing scripts DPkg::Post-Invoke '/usr/libexec/apparmor-profile-everything/grub-cfg' after installing apparmor-profile-everything and trying to install apparmor-profiles-kicksecure