I'll add some context and explanation. Bitbake can use user namespaces to disconnect the networking for specific worker processes, which is an important isolation feature that would be unfortunate to have to disable on ubuntu hosts.
This is a very similar situation to buildah, which already has an apparmour profile to allow userns. The catch is that bitbake is not installed as part of the system, so you can't hardcode a path like /usr/bin/bitbake.
I'll add some context and explanation. Bitbake can use user namespaces to disconnect the networking for specific worker processes, which is an important isolation feature that would be unfortunate to have to disable on ubuntu hosts.
This is a very similar situation to buildah, which already has an apparmour profile to allow userns. The catch is that bitbake is not installed as part of the system, so you can't hardcode a path like /usr/bin/bitbake.