# AppArmor profile for Cella (installed by the .deb as /etc/apparmor.d/cella).
#
# Ubuntu 23.10+ only lets programs with a profile that allows it create unprivileged user
# namespaces, which WebKitGTK's bubblewrap sandbox needs; without it the document area
# stays blank. This profile confines nothing else: it is unconfined apart from granting
# `userns`, the same shape as the profiles Ubuntu ships for other sandboxed browsers.
# UNTESTED on a real Ubuntu 24.04 machine (see README-Linux.md ▸ Known risks).
abi <abi/4.0>,
include <tunables/global>

profile cella /usr/lib/cella/Cella flags=(unconfined) {
  userns,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/cella>
}
