Ok i figured a workaround (i would consider it as workaround because it reduces the host security):
Disable passt apparmor
sudo ln -s /etc/apparmor.d/usr.bin.passt /etc/apparmor.d/disable/
- Unload it from the kernel memory:
sudo apparmor_parser -R /etc/apparmor.d/usr.bin.passt
- Reload the apparmor:
sudo systemctl reload apparmor
- Verify its disabled (should return nothing):
sudo aa-status | grep passt
Disable Apparmor restricted unprivliges
sudo nano /etc/sysctl.d/60-whonix-bypass.conf
Disable it by pasting:
kernel.apparmor_restrict_unprivileged_userns = 0
Apply it:
sudo sysctl --system
Verify its mentioned with 0 by running:
sysctl kernel.apparmor_restrict_unprivileged_userns
Tor will work inside GW and WS after that.
@Patrick since we rely on apparmor atm, we need to have an adjusted/compatible passt apparmor profile or maybe just highlight what to change.