Apparmor not starting/ edit kernel cmd line?

I was running home assistant on rock PI4B, for a while everything was fine, until it wasn’t. HA stopped updating itself and pluggins due to “AppArmor is not enabled on the host”. When i do

rock@rockpi4b:~$ sudo aa-status
apparmor module is loaded.
apparmor filesystem is not mounted.

rock@rockpi4b:~$ aa-enabled
No - disabled at boot.

security fs seems to be mounted

rock@rockpi4b:~$ mount | grep security
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)

though /sys/kernel/security is empty

HA docs suggest adding "apparmor=1 security=apparmor" to kernel command line. How would this be done with u-boot?