From 39711cf6c2ec5a3b4480dcb4800cc3802bda5bf2 Mon Sep 17 00:00:00 2001
From: Lukasz Kasprzak <lukasz.kasprzak@pm.me>
Date: Fri, 20 Mar 2026 19:16:32 +0100
Subject: feat: first fully successful run e2e on straper

---
 .../public/apparmor/apparmor.d/unprivileged_userns | 27 ++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 straper/db/public/apparmor/apparmor.d/unprivileged_userns

(limited to 'straper/db/public/apparmor/apparmor.d/unprivileged_userns')

diff --git a/straper/db/public/apparmor/apparmor.d/unprivileged_userns b/straper/db/public/apparmor/apparmor.d/unprivileged_userns
new file mode 100644
index 0000000..bac3f26
--- /dev/null
+++ b/straper/db/public/apparmor/apparmor.d/unprivileged_userns
@@ -0,0 +1,27 @@
+# Special profile transitioned to by unconfined when creating an unprivileged
+# user namespace.
+#
+abi <abi/4.0>,
+include <tunables/global>
+
+profile unprivileged_userns flags=(complain) {
+     audit deny capability,
+     audit deny change_profile,
+
+     # allow block to be replaced by allow when x dominance test is fixed
+     #allow all,
+     allow network,
+     allow signal,
+     allow dbus,
+     allow file rwlkm /**,
+     allow unix,
+     allow mqueue,
+     allow ptrace,
+     allow userns,
+
+     # stack children to strip capabilities
+     allow pix /** -> &unprivileged_userns ,
+
+     # Site-specific additions and overrides. See local/README for details.
+     include if exists <local/unprivileged_userns>
+}
-- 
cgit v1.3