Whonix documentation to include Ubuntu AppArmor workaround for passt networking

Whonix developers have agreed to update the project's official documentation to address networking failures encountered by users running Whonix on Ubuntu-based distributions. The issue specifically affects users attempting to use the passt networking approach within QEMU/KVM environments, where the Whonix-Gateway fails to establish a connection to the Tor network.

The root cause has been identified as an AppArmor configuration in Ubuntu that interferes with the networking requirements of passt. While the Whonix-KVM maintainer suggests filing bug reports with specific Linux distributions, the project leadership has confirmed that the workaround should be formally documented in the Whonix wiki to assist the widespread Ubuntu user base.

AppArmor interference with passt networking

• Networking Conflict: The passt networking implementation in Whonix QEMU/KVM setups fails to connect to Tor on Ubuntu systems due to default AppArmor restrictions.
• Kernel Configuration: A documented workaround involves adjusting the kernel setting kernel.apparmor_restrict_unprivileged_userns, which affects how unprivileged user namespaces are handled.
• Distribution Specificity: The issue was specifically observed on Ubuntu 24.04 and Ubuntu 26.04 (Kubuntu 26.04.1 LTS) environments.
• Documentation Gap: Users reported that while Whonix has transitioned toward the passt approach, official guides lacked sufficient detail regarding interface configuration and troubleshooting for this specific stack.

Why it matters

This development is significant for privacy-focused users on Ubuntu who rely on Whonix for anonymity, as it provides a path to use modern networking stacks without compromising security through undocumented workarounds. It also highlights the ongoing friction between strict security profiles like AppArmor and emerging virtualization networking technologies.