apparmor base drop-in: remove chroot/overlay paths

As the upstream AppArmor base abstraction does not
contain references to paths in /run/firejail/mnt/oroot
there is not much point to have them in our drop-in

1 files changed, 8 insertions, 7 deletions

diff --git a/etc/apparmor/firejail-base b/etc/apparmor/firejail-base
index 41e4ac2bf..6e286d4af 100644
--- a/etc/apparmor/firejail-base
+++ b/etc/apparmor/firejail-base
@@ -1,26 +1,27 @@
 #########################################
 # Firejail base abstraction drop-in
-#########################################
-
+#
 # Adds basic Firejail support to AppArmor profiles.
 # Please note: Firejail's nonewprivs and seccomp options
 # are not compatible with AppArmor profile transitions.
+# Also there is no support for Firejail chroot options.
+#########################################
 
 # Discovery of process names
-owner /{,run/firejail/mnt/oroot/}proc/@{pid}/comm r,
+owner /proc/@{pid}/comm r,
 
 ##########
 # Following paths only exist inside a Firejail sandbox
 ##########
 
 # Library preloading
-/{,run/firejail/mnt/oroot/}{,var/}run/firejail/lib/*.so mr,
+/{,var/}run/firejail/lib/*.so mr,
 
 # Supporting seccomp
-owner /{,run/firejail/mnt/oroot/}{,var/}run/firejail/mnt/seccomp/seccomp.postexec r,
+owner /{,var/}run/firejail/mnt/seccomp/seccomp.postexec r,
 
 # Supporting trace
-owner /{,run/firejail/mnt/oroot/}{,var/}run/firejail/mnt/trace w,
+owner /{,var/}run/firejail/mnt/trace w,
 
 # Supporting tracelog
-/{,run/firejail/mnt/oroot/}{,var/}run/firejail/mnt/fslogger r,
+/{,var/}run/firejail/mnt/fslogger r,