Hi

The solution might be to write an AppArmor profile, e.g. under /etc/apparmor.d/firefox-local, with content (replace <USER> with your username ; here it is assumed the firefox install lives under $HOME/bin/ ):

(This profile allows everything and only exists to give theapplication a name instead of having the label "unconfined".)

abi <abi/4.0>, include <tunables/global>

profile firefox-local /home/<USER>/bin/firefox/{firefox,firefox-bin,updater} flags=(unconfined) {

 userns,

 # Site-specific additions and overrides. See local/README for details.
 include if exists <local/firefox>

}

The proceeding with a sudo systemctl restart apparmor.service should be enough.

I arrived here because starting with Firefox 129.0 a warning is shown on every start (Firefox installed as regular package with apparmor enforced profile, not flatpak). It links to an support article about apparmor and user namespaces, which includes Paul's suggestion to create an apparmor profile.

However, as the example profile notes, it does not enforce any restrictions. Moreover the warning only resolves itself, if the system has unprivileged user namespaces enabled. This is contrary to common recommendations to disable it, if possible.[1] Hence, I'd like to add the question: why does FF now start with the warning?

Some relevant resources (@ixian: the second link covers some info for your last question): [1] Apparmor wiki information for user namespaces and browsers [2] Mozilla wiki for Sandboxes