# AppArmor profile for codex task containers (outer hardening).
#
# Based on Docker's default container profile, with stricter denies:
# - deny network raw: no raw sockets (ping/scan/sniff tricks)
# - deny ptrace: no process injection / debugging other processes
# - deny mount/umount: containers must never mount (bwrap path is
#   NOT enabled here; inner sandbox stays danger-full-access by
#   choice, so mount inside the container is pure attack surface)
# - deny dangerous capabilities (defense in depth; containers also
#   run with --cap-drop=ALL, so these are a second lock, not the
#   only one)
# - deny writes to /proc/sys, /sys, /proc/keys (kernel tunables)
#
# Deliberately NOT included: `userns` (that would enable the bwrap
# inner-sandbox path, which is a separate decision, not this one).
#
# Install: cp to /etc/apparmor.d/docker-codex, then
#   apparmor_parser -r /etc/apparmor.d/docker-codex
# Use: docker --security-opt apparmor=docker-codex
# (worker flag: --docker-security-opt apparmor=docker-codex)
# Verify: docker inspect <container> shows
#   "AppArmorProfile": "docker-codex" (not "docker-default").

#include <tunables/global>

profile docker-codex flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

  network inet stream,
  network inet dgram,
  network inet6 stream,
  network inet6 dgram,
  deny network raw,

  capability chown,
  capability dac_override,
  capability fsetid,
  capability fowner,
  capability mknod,
  capability net_bind_service,
  capability setfcap,
  capability setgid,
  capability setpcap,
  capability setuid,
  capability sys_chroot,
  deny capability sys_admin,
  deny capability sys_ptrace,
  deny capability net_admin,
  deny capability net_raw,
  deny capability sys_module,
  deny capability sys_rawio,
  deny capability sys_boot,
  deny capability sys_time,
  deny capability mac_admin,
  deny capability mac_override,

  deny mount,
  deny umount,
  deny pivot_root,
  deny ptrace,

  file,
  deny @{PROC}/sys/** w,
  deny @{PROC}/sysrq-trigger rw,
  deny @{PROC}/keys/** rw,
  deny @{PROC}/kcore rw,
  deny /sys/** w,
  deny /etc/shadow rw,
  deny /etc/gshadow rw,

  signal,
  unix,
  dbus,
  ptrace (readby),
}