#!/usr/bin/env bash
set -euo pipefail
if [[ $(id -u) != 0 ]]; then
    echo 'Run with sudo: sudo bash setup-ubuntu.sh' >&2
    exit 1
fi
command -v apparmor_parser >/dev/null || { echo 'Install apparmor first.' >&2; exit 1; }
workspace=$(mktemp -d)
trap 'rm -rf "$workspace"' EXIT
cat > "$workspace/outer-loop" <<'POLICY'
abi <abi/4.0>,
include <tunables/global>
profile outer-loop-release "@{HOME}/.local/opt/outer-loop/releases/*/bin/outer-loop" flags=(unconfined) {
    userns,
}
profile outer-loop-session-release "@{HOME}/.local/opt/outer-loop/releases/*/bin/outer-loop-session" flags=(unconfined) {
    userns,
}
POLICY
apparmor_parser --skip-kernel-load "$workspace/outer-loop"
install -o root -g root -m644 "$workspace/outer-loop" /etc/apparmor.d/outer-loop-release
apparmor_parser --replace /etc/apparmor.d/outer-loop-release
echo 'Outer Loop sandbox permission installed. System-wide namespace restrictions are unchanged.'