apparmor/profiles/apparmor.d/systemd-coredump

# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"

abi <abi/4.0>,
include <tunables/global>

profile systemd-coredump /usr/lib/systemd/systemd-coredump flags=(unconfined) {
  userns,
  @{exec_path} mrix,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/systemd-coredump>
}
add profiles for applications that create user namespaces These are profiles for applications that create user namespaces, both the actual policy and unconfined profiles, like it was done in MR 1123. https://gitlab.com/apparmor/apparmor/-/merge_requests/1123 In addition this serves as a handle to uniquely identify these applications instead of unconfined to peers in policy. Note that unconfined mode should be changed for default_allow when https://gitlab.com/apparmor/apparmor/-/merge_requests/1109 is merged. Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com> 2024-02-02 10:51:06 -03:00			`# This profile allows everything and only exists to give the`
			`# application a name instead of having the label "unconfined"`

			`abi <abi/4.0>,`
			`include <tunables/global>`

			`profile systemd-coredump /usr/lib/systemd/systemd-coredump flags=(unconfined) {`
			`userns,`
profiles: update the rest of the profiles to use @{exec_path} Signed-off-by: John Johansen <john.johansen@canonical.com> 2025-04-28 13:17:49 -07:00			`@{exec_path} mrix,`
add profiles for applications that create user namespaces These are profiles for applications that create user namespaces, both the actual policy and unconfined profiles, like it was done in MR 1123. https://gitlab.com/apparmor/apparmor/-/merge_requests/1123 In addition this serves as a handle to uniquely identify these applications instead of unconfined to peers in policy. Note that unconfined mode should be changed for default_allow when https://gitlab.com/apparmor/apparmor/-/merge_requests/1109 is merged. Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com> 2024-02-02 10:51:06 -03:00
			`# Site-specific additions and overrides. See local/README for details.`
			`include if exists <local/systemd-coredump>`
			`}`