AppArmor for Complete System - Including init, PID1, Systemd, Everything! - Full System MAC policy

[Patrick]

@madaidan

@Patrick

Possible to just make selective edits to that systemd unit file?

haveged works with a drop-in specifying NoNewPrivileges=no but onion-grater/sdwdate didn’t seem to work that way.

This caused confusion:

Full System AppArmor Policy - Testers Wanted!

Known issue if it can be called that. https://forums.whonix.org/t/apparmor-for-complete-system-including-init-pid1-systemd-everything-full-system-mac-policy/8339/419 But since it got forgotten and confused all of us, a better implementation is desirable. Best to add any error messages as comment in the source code so it can at least be remembered when grepping the source code. Was introduced here: https://github.com/Whonix/apparmor-profile-everything/pull/61 → https://forums.whonix.org/t/…

Why a drop-in cannot be used? Is there an upstream bug report for this?