AppArmor enabled by default in templates

[Andrzej Andrzej]

I do not understand why AppArmor is not enabled by default in Qubes for each template. You could enable it by default for each template to increase security. In systems such as Whonix, from what I remember it is enabled by default. If there is no strong justification for this, then you can enable this functionality. I suspect that this may be due to the fact that AppArmor profiles may cause little confusion and complications.

[awokd]

Search the Qubes mailing lists for discussions about VM hardening. Short
version is https://www.qubes-os.org/security/goals/.