AppArmor profile per binary path with install hint; verified network examples

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/cli.cpp

@@ -112,6 +112,7 @@ void Cli::usage(std::FILE* out) {
         "  doos image list\n"
         "  doos image add [--sha256 HEX] SOURCE [NAME]\n"
         "  doos image delete [--yes] NAME\n"
+        "  doos apparmor          print the AppArmor profile this binary needs on Ubuntu 24.04+\n"
         "\n"
         "options:\n"
         "  --image NAME           start from an image instead of the host system (fetched on demand)  [fixed]\n"
@@ -144,6 +145,7 @@ int Cli::run() {
     if (cmd == "attach") return cmdAttach(rest);
     if (cmd == "delete") return cmdDelete(rest);
     if (cmd == "image") return cmdImage(rest);
+    if (cmd == "apparmor") return cmdApparmor();
     std::fprintf(stderr, "doos: unknown command '%s'\n\n", args_[0].c_str());
     usage(stderr);
     return 2;
@@ -187,6 +189,11 @@ int Cli::cmdDelete(std::vector<std::string> rest) {
     return 0;
 }
 
+int Cli::cmdApparmor() {
+    std::fputs(Sandbox::apparmorProfile().c_str(), stdout);
+    return 0;
+}
+
 int Cli::cmdImage(std::vector<std::string> rest) {
     if (rest.empty()) throw std::runtime_error("image needs a subcommand: list, add, delete");
     std::string sub = rest[0];