abi <abi/4.0>,
include <tunables/global>

# Ubuntu 23.10+ restricts unprivileged user namespaces via AppArmor, which is
# what Chromium's sandbox needs. Without a profile like this an Electron app
# either refuses to start or has to run with --no-sandbox. Granting `userns`
# here lets Asset Lab keep the full Chromium sandbox instead.
profile asset-lab "/opt/Asset Lab/asset-lab" flags=(unconfined) {
  userns,

  # Site-local overrides, if an administrator adds any.
  include if exists <local/asset-lab>
}
