On 5/23/20 9:54 PM, Jim Jackson wrote:
> Generally, why does apparmor get installed on a dist-upgrade, when it
> wasn't there initially? It isn't as if it's a new "thing".

in repos since wheezy.. from beowulf/buster on, it is enabled by default:
https://wiki.debian.org/AppArmor/HowToUse#Enable_AppArmor

> I got it
> on my ascii -> beowulf upgrade, and removed it.

https://wiki.debian.org/AppArmor/HowToUse#Disable_AppArmor
--

if anyone wants to disable/debug apparmor for a specific profile, you
can use :
aa-complain /etc/apparmor.d/some.profile
everything will work, with all DENIED msgs printed to dmesg for
review-fixes.