As far i know to setup selinux in qubes a users have to do do this How to install & activate SELinux on minimal fedora templates? - #2 by Gandalfen So i guess for apparmor we must do the same thing (?)
I didn’t test if a users really need to do the qvm-prefs kernelopts commands i don’t know if apparmor will deny access correctly if you don’t do it. And the apparmor profile for tor browser in whonix seem to work without the qvm-prefs commands so i guess we probably not need to use the commands ? I won’t lie i don’t know at all some test are needed
qvm-prefs x kernelopts "swiotlb=2048 apparmor=1 security=apparmor"