AppArmor not automatically installed

[NikkiSatmaka]

I found that AppArmor is not automatically installed. What's the reason behind this?

I like that you remove some apps on purpose, especially the games on gnome and disabling wayland from the get go.

But isn't AppArmor kind of important for security?

[geckolinux]

But isn't AppArmor kind of important for security?

For the general usage profile of a desktop system behind a NAT firewall using vetted packages from the official Debian and/or Flathub repositories it doesn't seem necessary. Feel free to install it though if desired.

[bliu13]

@geckolinux, I believe AppArmor is Mandatory Access Control. From what I understand, it's supposed to define what an installed application is allowed and not allowed to access. From what the Quick Introduction says, it should help mitigate some potentially nasty threats. I would like to also vouch for some MAC to be installed by default. People might assume AppArmor is installed by default because Debian also installs it by default.

[geckolinux]

@bliu13 and @NikkiSatmaka Have you noticed any limitations or things requiring additional configuration when AppArmor is installed?

[bliu13]

@gecklinux I didn't notice any limitations. When I tried to install apparmor and the recommended dependencies, I just followed the official instructions. You'll need to configure the bootloader to start apparmor at boot. There is another package called apparmor-profiles-extra that is also mentioned in the documentation that I also installed that had Debian specific profiles and I did not see any issues when it was installed.

Now... If you really wanted to deviate from Debian's default installation configuration, you could also try your hand with SELinux, but the problem is that because it's not default, I don't really know how much TLC the Debian maintainers put in to support SELinux. I have never tried to use SELinux on Debian.