# This profile is managed by the kiro package.
# It is installed to /etc/apparmor.d/kiro by the package's postinst and is
# replaced on upgrade, so put local additions in /etc/apparmor.d/local/kiro.
#
# It lets Kiro create unprivileged user namespaces, which Chromium's
# sandbox needs, on systems that restrict them (Ubuntu 24.04 and later). It
# does not confine the app. It has the same shape as Ubuntu's profile for
# VS Code (/etc/apparmor.d/code).
abi <abi/4.0>,
include <tunables/global>

profile kiro /usr/share/kiro/kiro flags=(unconfined) {
  userns,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/kiro>
}
