Agreed. For most users, it’s definitely easier to just disable it completely for now instead of trying to fix everything manually.
No, it’s not, and having read a few tutorials, I’m not really looking forward to switching to it. While SELinux does appear to be much more flexible than AppArmor, its configuration language is much more complicated. Not being a Linux expert, I’d prefer to avoid having to go down this rabbit hole in the first place.
@suse_rasputin and @Player701 Hi, if/when you switch to SELinux and do have an issue, there is a link in the Forum side panel to the SELinux Portal on what information to collect for a bug report. The SELinux folks are very responsive and in most cases get a fix into the SELinux policy release…
I’ve had one issue with SELinux here related to rasdaemon, that fix took a little longer as a fix was needed by upstream, aside from that it’s been a non-event across multiple systems.
I had an issue with lsblk stopping timeshift by preventing it from finding proper devises. It was diagnosed as caused by apparmor and fixed by adjusting apparmor config file for lsblk.
I have since changed to selinux and not had any problem for 6 hours or so.
tom kosvic
That is quite some FUD. It needs some understanding what openQA is and what scenarios it can cover. It isn’t possible to catch all issues and missfunctions with openQA. Package incompatibilities and stuff like that are quite possible to catch, but not 100% of the functions of the package.
openQA results for TW build 20260518 has 90 failed tests including multiple tests containing “apparmor” in its name. See report here: https://openqa.opensuse.org/tests/overview?distri=aeon&distri=microos&distri=opensuse&version=Tumbleweed&build=20260518&groupid=1
And are those failing tests these issues or something completely different?
No snapshot is released with 100% tests succeeding because not all test failures are showstoppers.
So unless you’re going to dig into those to show that disastrous bugs were ignored, just pointing at a number and screaming “SEE” doesn’t mean anything. And no idea what you’re looking at, your own link has ‘Failed: 32’
Problem is, I’ve had to tweak AppArmor profiles before to ensure certain programs are not too heavily restricted - the most trivial example I can think of is that the default profile for PHP-FPM does not allow it to send mail. It was very easy to fix, and I’m not saying it would’ve been impossible to do if I had been using SELinux - it’s just that its configuration langauge seems more complicated to me at first glance, and I simply don’t want to spend any extra effort learning it if I can avoid it. It’s the natural human resistance to change, nothing more.
I guess I’d have no choice if AppArmor support in openSUSE were to be officially discontinued, but for now I’d prefer to keep using it for as long as I can.
Reported everything that has not already been reported before. Unsurprisingly, I could easily reproduce all errors on a clean system, just by installing the affected package and attempting to run it - without even a single configuration change.
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.