# Allows doos to use unprivileged user namespaces on Ubuntu 24.04+ where
# kernel.apparmor_restrict_unprivileged_userns=1 strips capabilities (mount, etc.)
# from unknown binaries inside a new userns. Same pattern as /etc/apparmor.d/lxc-unshare.
# The profile is unconfined apart from granting `userns`; confinement comes from doos itself.
abi <abi/5.0>,
include <tunables/global>

profile doos /{usr/local/bin,home/*/projects/doos/build}/doos flags=(unconfined) {
  userns,
  @{exec_path} mr,
}
