# AppArmor profile for epkg
# Allows epkg to create namespaces and perform mounts for container functionality

include <tunables/global>

profile epkg /home/*/.epkg/envs/*/usr/bin/epkg flags=(attach_disconnected) {
  # Include basic abstractions
  include <abstractions/base>
  include <abstractions/bash>
  include <abstractions/nameservice>

  # Allow all file access (needed for package management)
  file,

  # Allow execution of binaries
  /** ix,

  # Required capabilities for namespace and mount operations
  capability sys_admin,
  capability chown,
  capability setuid,
  capability setgid,
  capability setpcap,
  capability dac_override,
  capability dac_read_search,
  capability fowner,
  capability fsetid,

  # Allow user namespace creation
  userns,

  # Allow mount operations (required for container root filesystem)
  mount,
  remount,
  umount,
  pivot_root,

  mount options=(rw, rprivate) -> /,

  /dev/pts/* rw,

  /home/*/.epkg/envs/** rmix,

  /etc/ld.so.cache r,
  /lib/** rm,
  /usr/lib/** rm,

  # Allow network operations
  network,

  # Allow signal handling
  signal,

  # Allow process management
  ptrace,
  unix,
}
