# AppArmor profile for the Catflap desktop app. It confines nothing: it only
# allows the unprivileged user namespaces that WebKitGTK's sandbox for web
# content (bubblewrap) needs. Ubuntu 23.10 and newer, and systems built on
# it, deny them to programs without a profile, and the app then dies at start
# with "bwrap: setting up uid map: Permission denied".
# The .deb installs it to /etc/apparmor.d where AppArmor 4 is present
# (packaging/linux/postinstall.sh); local additions go to
# /etc/apparmor.d/local/catflap-desktop.
abi <abi/4.0>,
include <tunables/global>

profile catflap-desktop /usr/bin/catflap-desktop flags=(unconfined) {
  userns,

  include if exists <local/catflap-desktop>
}
