enable AppArmor for home-assistant?

[0asisX]

HA is complaining that AppArmor isn't running (https://www.home-assistant.io/more-info/unsupported/apparmor).
Google suggests modifying /etc/default/grub but it doesn't exist.
Some threads in HA community specifically about Opi5 and AppArmor suggest to change /boot/OrangepiEnv.txt which also doesn't exist.
What is the correct way to do it with this ubuntu version?

[Joshua-Riek]

Yeah, I need to implement some Env.txt like Armbian does. I have some instructions written below, and please let me know if you have any troubles.

1. Edit the file /boot/firmware/boot.cmd with sudo privileges.
2. Edit the line that begins with env set bootargs (line 6 to be exact) and insert apparmor=1 security=apparmor at the end of the line inside the quotes.
3. Re-compile the boot script:

sudo mkimage -A arm64 -O linux -T script -C none -n "Boot Script" -d /boot/firmware/boot.cmd /boot/firmware/boot.scr

4. Reboot

[0asisX]

Worked perfectly, thanks for the quick response and all your work!

[Joshua-Riek]

You are welcome :)

[lijian870327]

I can't find this files " /boot/firmware/boot.cmd"。

root@ubuntu:/# ls /boot config-6.1.0-1009-rockchip initrd.img-6.1.0-1009-rockchip System.map-6.1.0-1011-rockchip vmlinuz-6.1.0-1012-rockchip config-6.1.0-1011-rockchip initrd.img-6.1.0-1011-rockchip System.map-6.1.0-1012-rockchip vmlinuz-6.1.0-1013-rockchip config-6.1.0-1012-rockchip initrd.img-6.1.0-1012-rockchip System.map-6.1.0-1013-rockchip vmlinuz.old config-6.1.0-1013-rockchip initrd.img-6.1.0-1013-rockchip vmlinuz extlinux initrd.img.old vmlinuz-6.1.0-1009-rockchip initrd.img System.map-6.1.0-1009-rockchip vmlinuz-6.1.0-1011-rockchip

[hhyygg2009]

in armbian, try to edit /boot/armbianEnv.txt is OK, after edit restart system

add in /boot/armbianEnv.txt:

apparmor=1
security=apparmor

command test for setting:
`grep APPARMOR /boot/config-*

armbian:~$ grep APPARMOR /boot/config-*
CONFIG_SECURITY_APPARMOR=y
# CONFIG_SECURITY_APPARMOR_DEBUG is not set
CONFIG_SECURITY_APPARMOR_INTROSPECT_POLICY=y
CONFIG_SECURITY_APPARMOR_HASH=y
CONFIG_SECURITY_APPARMOR_HASH_DEFAULT=y
CONFIG_SECURITY_APPARMOR_EXPORT_BINARY=y
CONFIG_SECURITY_APPARMOR_PARANOID_LOAD=y
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set

`