# memost — installed by the .deb as /etc/apparmor.d/memost (a conffile), and by
# scripts/install-user.sh when it is given root.
#
# It confines nothing (flags=unconfined). It exists to grant `userns`: the
# editor is WebKitGTK 6.0, whose web process runs inside a bubblewrap sandbox
# that needs an unprivileged user namespace, and Ubuntu 23.10+ withholds that
# from programs no profile names (kernel.apparmor_restrict_unprivileged_userns=1).
# Without it WebKit aborts at launch ("Failed to fully launch dbus-proxy") and
# no window appears. Same shape as Ubuntu's own /etc/apparmor.d/epiphany.
#
# Both install locations: the package's /usr/bin/memost and the per-user
# ~/.local/bin/memost (@{HOME} follows @{HOMEDIRS}, so homes outside /home are
# covered once tunables/home.d names them).

abi <abi/4.0>,
include <tunables/global>

profile memost /{usr/bin/memost,@{HOME}/.local/bin/memost} flags=(unconfined) {
  userns,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/memost>
}
