Package: apparmor
Version: 2.13.6-10
Severity: normal
Tags: patch
X-Debbugs-Cc: ava...@arkane-systems.net
Dear Maintainer,
There is an issue with the apparmor package not functioning
appropriately when installed on Debian running under the Windows Subsystem
for Linux. Specifically, systemd-detect-virt detects WSL as a container,
technically accurately, but this then causes the apparmor.systemd script
to decline to start apparmor.
This is problematic, essentially, because while Debian-in-WSL is
technically a container, there is no accessible "host" above it that might
be setting AppArmor policies to be interfered with; just the WSL
distro-management foo. As such, in this case, it makes more sense to treat
Debian-in-WSL as a non-container for AppArmor purposes.
A patch to enable this follows:
--- apparmor.systemd.old 2021-05-07 11:54:24.786143397 -0500
+++ apparmor.systemd.new 2021-05-07 11:53:52.773126996 -0500
@@ -73,6 +73,7 @@
start)
if [ -x /usr/bin/systemd-detect-virt ] && \
systemd-detect-virt --quiet --container && \
+ [ $(systemd-detect-virt --container) != "wsl" ] \
! is_container_with_internal_policy; then
aa_log_daemon_msg "Not starting AppArmor in container"
aa_log_end_msg 0
@@ -88,6 +89,7 @@
restart|reload|force-reload)
if [ -x /usr/bin/systemd-detect-virt ] && \
systemd-detect-virt --quiet --container && \
+ [ $(systemd-detect-virt --container) != "wsl" ] \
! is_container_with_internal_policy; then
aa_log_daemon_msg "Not starting AppArmor in container"
aa_log_end_msg 0
-- System Information:
Debian Release: 11.0
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 5.10.16.3-microsoft-custom-WSL2+ (SMP w/4 CPU threads)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US.UTF-8
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages apparmor depends on:
ii debconf [debconf-2.0] 1.5.76
ii libc6 2.31-12
ii lsb-base 11.1.0
apparmor recommends no packages.
Versions of packages apparmor suggests:
ii apparmor-profiles-extra 1.33
ii apparmor-utils 2.13.6-10
-- debconf information excluded
-- debsums errors found:
debsums: changed file /lib/apparmor/apparmor.systemd (from apparmor package)
