# AppArmor profile for BrowserOS
# This profile allows everything and only exists to give the application
# a name instead of having the label "unconfined", and to grant permission
# to create unprivileged user namespaces (required for Chromium sandbox on
# Ubuntu 23.10+ and other distros that restrict userns via AppArmor).

abi <abi/4.0>,
include <tunables/global>

profile browseros /usr/lib/browseros/browseros flags=(unconfined) {
  userns,

  include if exists <local/browseros>
}
