apparmor/profiles/apparmor.d/github-desktop

# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"

abi <abi/4.0>,
include <tunables/global>

profile github-desktop /usr/lib/github-desktop/github-desktop flags=(unconfined) {
  userns,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/github-desktop>
}
add profiles for applications in unconfined mode Adding profiles for applications even if they allow all operations will allow them to be referenced as peer by other policies. This is a step towards a more comprehensive system policy, adding names, instead of just unconfined, to peers of existing policy and to applications that are known to use unprivileged user namespaces. Note that unconfined mode should be changed for default_allow when https://gitlab.com/apparmor/apparmor/-/merge_requests/1109 is merged. Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com> 2023-11-22 16:16:38 -03:00			`# This profile allows everything and only exists to give the`
			`# application a name instead of having the label "unconfined"`

			`abi <abi/4.0>,`
			`include <tunables/global>`

			`profile github-desktop /usr/lib/github-desktop/github-desktop flags=(unconfined) {`
			`userns,`

			`# Site-specific additions and overrides. See local/README for details.`
profiles: convert local include to match profile name The recently added unconfined profiles use the binary name for the local include instead of the profile name. Switch to using the profile name for the local include. Signed-off-by: John Johansen <john.johansen@canonical.com> 2023-11-24 18:52:09 -08:00			`include if exists <local/github-desktop>`
add profiles for applications in unconfined mode Adding profiles for applications even if they allow all operations will allow them to be referenced as peer by other policies. This is a step towards a more comprehensive system policy, adding names, instead of just unconfined, to peers of existing policy and to applications that are known to use unprivileged user namespaces. Note that unconfined mode should be changed for default_allow when https://gitlab.com/apparmor/apparmor/-/merge_requests/1109 is merged. Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com> 2023-11-22 16:16:38 -03:00			`}`