Should I use Apparmor

General Discussion
1

My Pi5 used as a local home server running (10.5) Nginx (local web testing) , Jellyfin and Nextcloud (with remote access)

Recent updates suggest ‘apparmor’ as Recommended package.
I know what apparmor is but the questions are:
Should I install it?
Will it offer significant extra security or extra load?

2

AppArmor is an additional security layer, and as such, does not hurt to be enabled. All you need to do is to install the apparmor APT package.

But we did not really test all shipped default profiles against our dietpi-software setups. We do adjust paths away from package defaults in cases, which might require AppArmor profile overrides. E.g. our webserver setups have their root at /var/www instead of /var/www/html, and other applications often have their data dirs at /mnt/dietpi_userdata/<name> instead of /var/lib/<name>.

There is an issue open about it: DietPi-Software | AppArmor · Issue #3082 · MichaIng/DietPi · GitHub
If someone finds time to test it with out software setups, we could (incrementally) add AppArmor profile overrides. Once all default profiles are tested and in case covered, I would consider to preinstall AppArmor on DietPi.

However, it should be kept in mind that AppArmor only has an effect if there actually is a profile for a particular executable. When using systemd units, their own sandboxing layer (which is increasingly commonly/strictly used), does moreless the same. But AppArmor blocks in the kernel, and on executable level, i.e. it does not matter how the executable is invoked. Additional load shouldn’t be measurable, as it all happens in the kernel.

In your particular case:

  • There does not seem to be an Nginx profile, but a PHP profile is there. But the latter one cannot be very strict, as far as I can imagine.
  • MariaDB does ship an own profile, might be needed to extend it because of the changed data dir.
  • Redis has none.
  • Jellyfin has more likely none either, but I guess you will find a template in their documentation or community forum.
3

Thank @MichaIng for such a detailed answer.
Given the minimal external exposure and its use I think I’ll leave the addition of apparmor for now. Maybe look at it later when I want to have a ‘play’.
Nothing on it is critical, the information is of little value to anybody else and in the highly unlikely event of it being compromised a complete restore or rebuild is simple.

Thanks again.