feat(profiles): general update.

apparmor.d/abstractions/fontconfig-cache-write

@@ -36,6 +36,6 @@
   # For fonts downloaded via font-manager (###FIXME### when they fix resolving of vars)
   owner @{user_share_dirs}/fonts/ rw,
   owner @{user_share_dirs}/fonts/**/.uuid{,.NEW,.LCK,.TMP-*} rw,
-   link @{user_share_dirs}/fonts/**/.uuid.LCK -> /home/*/.local/share/fonts/**/.uuid.TMP-*,
+   link @{user_share_dirs}/fonts/**/.uuid.LCK -> @{user_share_dirs}/fonts/**/.uuid.TMP-*,
 
   include if exists <abstractions/fontconfig-cache-write.d>

apparmor.d/groups/apt/apt-methods-store

@@ -44,6 +44,7 @@ profile apt-methods-store @{exec_path} {
   /root/ r,
 
         /var/lib/apt/lists/{,**} r,
+        /var/lib/ubuntu-advantage/apt-esm/{,**} r,
   owner /var/lib/apt/lists/* rw,
   owner /var/lib/apt/lists/partial/* rw,
   owner /var/lib/ubuntu-advantage/apt-esm/{,**} rw,

apparmor.d/groups/apt/dpkg-preconfigure

@@ -35,6 +35,7 @@ profile dpkg-preconfigure @{exec_path} {
   owner /tmp/*.template.* rw,
   owner /tmp/*.config.* rwPUx,
 
+  owner /var/cache/debconf/ rw,
   owner /var/cache/debconf/{config,passwords,templates}.dat{,-old,-new} rwk,
   owner /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
 

apparmor.d/groups/bus/dbus-daemon

@@ -58,6 +58,8 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
   /usr/share/gnome-documents/org.gnome.Documents                          rPx,
   /usr/share/org.gnome.Characters/org.gnome.Characters                    rPx,
   /usr/share/org.gnome.Characters/org.gnome.Characters.BackgroundService  rPx,
+  @{user_share_dirs}/gnome-shell/extensions/gsconnect@andyholmes.github.io/service/daemon.js rPx,
+  /usr/share/gnome-shell/extensions/gsconnect@andyholmes.github.io/service/daemon.js rPx,
 
   /etc/dbus-1/{,**} r,
 

apparmor.d/groups/systemd/systemd-tmpfiles

@@ -19,6 +19,7 @@ profile systemd-tmpfiles @{exec_path} flags=(attach_disconnected) {
   capability fsetid,
   capability mknod,
   capability net_admin,
+  capability sys_resource,
   capability syslog,
 
   @{exec_path} mr,

apparmor.d/groups/ubuntu/update-motd-updates-available

@@ -43,8 +43,8 @@ profile update-motd-updates-available @{exec_path} {
 
   /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
 
-  /var/cache/apt/ r,
+  owner /var/cache/apt/ rw,
-  /var/cache/apt/** rwk,
+  owner /var/cache/apt/** rwk,
 
   /tmp/ r,
 

apparmor.d/profiles-m-r/needrestart

@@ -49,10 +49,12 @@ profile needrestart @{exec_path} flags=(attach_disconnected) {
   /etc/needrestart/*.d/* rix,
   /etc/shadow r,
 
+  / r,
   /boot/ r,
   /boot/intel-ucode.img r,
   /boot/vmlinuz* r,
 
+  owner /var/lib/juju/agents/{,**} r,
   owner /var/cache/debconf/{config,passwords,templates}.dat{,-new,-old} rwk,
 
         @{PROC}/ r,

apparmor.d/profiles-m-r/newgrp

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2020-2021 Mikhail Morfikov
+# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -9,26 +10,19 @@ include <tunables/global>
 @{exec_path} = @{bin}/newgrp
 profile newgrp @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
   include <abstractions/nameservice-strict>
 
-  # To write records to the kernel auditing log.
   capability audit_write,
-
-  # To remove the following errors:
-  #  setgroups: Operation not permitted
-  #  setgid: Operation not permitted
   capability setgid,
-
-  # newgrp is a SETUID binary
   capability setuid,
 
   network netlink raw,
 
   @{exec_path} mr,
 
-  # Shells to use
+  @{bin}/{,b,d,rb}ash rUx,
-  @{bin}/{,b,d,rb}ash rPUx,
+  @{bin}/{c,k,tc,z}sh rUx,
-  @{bin}/{c,k,tc,z}sh rPUx,
 
   /etc/{passwd,group,shadow,gshadow} r,
 

apparmor.d/profiles-m-r/protonmail-bridge

@@ -57,6 +57,7 @@ profile protonmail-bridge @{exec_path}  {
     @{bin}/tty         rix,
     @{bin}/which       rix,
 
+         owner @{user_password_store_dirs}/ r,
          owner @{user_password_store_dirs}/.gpg-id r,
          owner @{user_password_store_dirs}/protonmail-credentials/{,**} rw,
     deny owner @{user_password_store_dirs}/**/ r,

apparmor.d/profiles-m-r/qemu-ga

@@ -21,6 +21,11 @@ profile qemu-ga @{exec_path} {
 
   ptrace peer=unconfined,
 
+  dbus send bus=system path=/org/freedesktop/login1
+       interface=org.freedesktop.login1.Manager
+       member={ScheduleShutdown,SetWallMessage}
+       peer=(name=org.freedesktop.login1, label=systemd-logind),
+
   @{exec_path} mr,
 
   @{bin}/systemctl rix,