# LawleyOS Portal (/usr/bin/lawleyos-browser).
# Ubuntu blocks unprivileged user namespaces for unconfined programs
# (kernel.apparmor_restrict_unprivileged_userns=1), which stops WebKit from
# starting its per-page sandbox (bubblewrap), so the Portal can't open.
# Like Ubuntu's profiles for Brave, Edge and Signal, this allows everything
# and only exists to permit creating that sandbox. The sandbox stays on.

abi <abi/4.0>,
include <tunables/global>

profile lawleyos-browser /usr/bin/lawleyos-browser flags=(unconfined) {
  userns,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/lawleyos-browser>
}
