12 lines
496 B
Plaintext
12 lines
496 B
Plaintext
# Allows doos to use unprivileged user namespaces on Ubuntu 24.04+ where
|
|
# kernel.apparmor_restrict_unprivileged_userns=1 strips capabilities (mount, etc.)
|
|
# from unknown binaries inside a new userns. Same pattern as /etc/apparmor.d/lxc-unshare.
|
|
# The profile is unconfined apart from granting `userns`; confinement comes from doos itself.
|
|
abi <abi/5.0>,
|
|
include <tunables/global>
|
|
|
|
profile doos /{usr/local/bin,home/*/projects/doos/build}/doos flags=(unconfined) {
|
|
userns,
|
|
@{exec_path} mr,
|
|
}
|