abi <abi/4.0>,
include <tunables/global>

# lab-app: read the image, run busybox, write only under /data.
# Anything not allowed here is denied, and AppArmor logs the denial.
profile lab-app flags=(attach_disconnected,mediate_deleted) {
  include <abstractions/base>

  /** r,
  /bin/busybox mrix,
  /data/** w,

  signal (receive) peer=unconfined,
}
