From 9f4ab9bc8980db909839276e9f5e9d904ee3d21a Mon Sep 17 00:00:00 2001
From: "prompt.ac/@jeffrey" <mail@aesthetic.computer>
Date: Sat, 5 Sep 2026 14:44:36 -0400
Subject: [PATCH] Allow Mediascholar sandbox profile transition

---
 papers/mediascholar/systemd/mediascholar.service | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/papers/mediascholar/systemd/mediascholar.service b/papers/mediascholar/systemd/mediascholar.service
index a3f0defdd6..6290f99ef4 100644
--- a/papers/mediascholar/systemd/mediascholar.service
+++ b/papers/mediascholar/systemd/mediascholar.service
@@ -28,7 +28,9 @@ TimeoutStopSec=30
 KillMode=mixed
 OOMPolicy=stop
 UMask=0077
-NoNewPrivileges=true
+# aa-exec must enter the named AppArmor profile before Bubblewrap creates the
+# namespace. Bubblewrap sets no_new_privs for the provider process itself.
+NoNewPrivileges=false
 PrivateTmp=true
 ProtectSystem=strict
 ProtectHome=read-only
-- 
2.54.0