[Help Welcome] KVM Development - staying the course

[nurmagoz]

@Patrick

• Is AppArmor sVirt confinement enabled by default in Debian?
• Is it enabled for Whonix VMs by default?
• How to verify it’s enabled by default?

Rootless virtual machines with KVM and QEMU

Went ahead and merged all working changes straight to the branch Made a feature request for sVirt to support qemu session

'Extending sVirt to work under qemu:///session' - MARC

svirt for current setup is N/A.

maybe the focus needs to be shifted to apparmor profiles like these:

Whonix-Gateway connects to tor however Whonix-Workstation does not

Ok i figured a workaround (i would consider it as workaround because it reduces the host security): Disable passt apparmor sudo ln -s /etc/apparmor.d/usr.bin.passt /etc/apparmor.d/disable/ Unload it from the kernel memory: sudo apparmor_parser -R /etc/apparmor.d/usr.bin.passt Reload the apparmor: sudo systemctl reload apparmor Verify its disabled (should return nothing): sudo aa-status | grep passt Disable Apparmor restricted unprivliges sudo nano /etc/sysctl.d/60-whonix-bypass.conf …