# Ubuntu 24.04 restricts unprivileged user namespaces unless the executable
# has an AppArmor profile that explicitly allows userns. This profile applies
# only to the root-owned Zhulan bwrap copy; that binary is executable only by
# root and the zhulan-runtime group.
abi <abi/4.0>,
include <tunables/global>

profile zhulan-remote-cell-bwrap /opt/guanghu/zhulan-remote-cell/runtime/zhulan-bwrap flags=(unconfined) {
  userns,
}