# Ant0: lets the Ant0 Browser engine create the user namespaces its sandbox needs where AppArmor
# restricts them (Ubuntu 23.10+, kernel.apparmor_restrict_unprivileged_userns). Same shape as
# Ubuntu's profile for Google Chrome; installed and loaded by the Ant0 package's postinst.
#
# It attaches only to the engines Ant0 installs per user in its default data folders. For a data
# folder elsewhere, add that folder's engine path to /etc/apparmor.d/local/ant0-browser.paths:
#   @{ant0_engine} += /srv/ant0/browsers/*/browser/chrome
# then run: sudo apparmor_parser -r /etc/apparmor.d/ant0-browser

abi <abi/4.0>,
include <tunables/global>

@{ant0_engine} = @{HOME}/.local/share/ant0/browsers/*/browser/chrome @{HOME}/.ant0/browsers/*/browser/chrome
include if exists <local/ant0-browser.paths>

profile ant0-browser @{ant0_engine} flags=(unconfined) {
  userns,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/ant0-browser>
}
