# AppArmor profile for the tofa desktop shell (cef-linux-design.md §5.3).
#
# Installed to /etc/apparmor.d/tofa-desktop by the deb and the rpm.
#
# WHY THIS FILE EXISTS. Ubuntu 23.10+ and Debian 13 ship
# `kernel.apparmor_restrict_unprivileged_userns=1`, which makes an
# unprivileged `unshare(CLONE_NEWUSER)` fail for any binary not covered by a
# profile that grants `userns`. Chromium's namespace sandbox is built on
# exactly that call, so on those distributions a bundled-Chromium application
# with no profile either runs with a degraded sandbox or does not start its
# renderers at all. Chrome, Chromium and every Electron app ship the same
# shape of profile; this is that pattern, not an invention.
#
# `flags=(unconfined)` means this profile grants no confinement of its own —
# it exists ONLY to re-permit user namespaces for these two executables, which
# is precisely the amount of policy we are qualified to write. The real
# confinement is Chromium's own sandbox, which this file is what makes
# possible.
#
# The deb/rpm ALSO install a setuid-root `chrome-sandbox`, which is the older
# mechanism and the one Chromium falls back to when namespaces are refused.
# The two are belt and braces on purpose: a distribution can disable either.
#
# `include if exists <local/...>` is the standard hook for a local admin
# override and must stay last.

abi <abi/4.0>,

include <tunables/global>

profile tofa-desktop "/usr/bin/tofa-desktop" flags=(unconfined) {
  userns,

  include if exists <local/tofa-desktop>
}

profile tofa-desktop-cef-helper "/usr/bin/tofa-desktop-cef-helper" flags=(unconfined) {
  userns,

  include if exists <local/tofa-desktop-cef-helper>
}
