| 1 | abi <abi/4.0>, |
| 2 | |
| 3 | include <tunables/global> |
| 4 | include <tunables/guix> |
| 5 | |
| 6 | # There’s no point in confining the guix executable, since it can run |
| 7 | # any user code and so everything is expected. We just need to |
| 8 | # explicitly enable userns for systems with the |
| 9 | # kernel.apparmor_restrict_unprivileged_userns sysctl. |
| 10 | profile guix @{guix_storedir}/{*-guix-command,*-guix-*/bin/guix} flags=(unconfined) { |
| 11 | userns, |
| 12 | } |