feat(profiles): merge the two packagekitd profiles in one.

apparmor.d/groups/ubuntu/packagekitd

@@ -1,116 +0,0 @@
-# apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
-# SPDX-License-Identifier: GPL-2.0-only
-
-abi <abi/3.0>,
-
-include <tunables/global>
-
-@{exec_path} = @{libexec}/packagekitd
-profile packagekitd @{exec_path} {
-  include <abstractions/base>
-  include <abstractions/apt-common>
-  include <abstractions/dbus-strict>
-  include <abstractions/nameservice-strict>
-
-  capability chown,
-  capability dac_override,
-  capability dac_read_search,
-  capability fowner,
-  capability kill,
-  capability setgid,
-  capability setuid,
-  capability sys_nice,
-
-  network netlink raw,
-
-  signal send set=int peer=apt-methods-*,
-
-  dbus (send,receive) bus=system path=/org/freedesktop/PackageKit
-       interface=org.freedesktop.{DBus.*,PackageKit},
-
-  dbus send bus=system path=/[0-9]*_@{hex}
-       interface=org.freedesktop.{DBus.Properties,PackageKit.Transaction}
-       peer=(name=org.freedesktop.DBus),
-
-  dbus send bus=system path=/org/freedesktop/NetworkManager
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll,
-
-  dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll,
-
-  dbus send bus=system path=/org/freedesktop/DBus{,/Bus}
-       interface=org.freedesktop.DBus
-       member={RequestName,GetConnectionUnixUser},
-
-  dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
-       interface=org.freedesktop.PolicyKit[0-9].Authority
-       member=CheckAuthorization,
-
-  dbus receive bus=system path=/[0-9]*_@{hex}
-       interface=org.freedesktop.{DBus.Properties,PackageKit.Transaction},
-      #  peer=(name=org.freedesktop.DBus),
-
-  dbus receive bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
-       interface=org.freedesktop.PolicyKit[0-9].Authority
-       member=Changed,
-
-  dbus receive bus=system path=/org/freedesktop/NetworkManager
-       interface=org.freedesktop.NetworkManager
-       member={CheckPermissions,DeviceAdded,DeviceRemoved,StateChanged},
-
-  dbus receive bus=system path=/org/freedesktop/NetworkManager
-       interface=org.freedesktop.DBus.Properties
-       member=PropertiesChanged,
-
-  dbus receive bus=system path=/org/freedesktop/login[0-9]
-       interface=org.freedesktop.login[0-9].Manager
-       member={SessionNew,PrepareForShutdown,SessionRemoved,UserNew,UserRemoved,PrepareForSleep}
-       peer=(name=:*, label=systemd-logind),
-
-  dbus bind bus=system 
-       name=org.freedesktop.PackageKit,
-
-  @{exec_path} mr,
-
-  /{usr/,}bin/{,ba,da}sh     rix,
-  /{usr/,}bin/appstreamcli   rPx,
-  /{usr/,}bin/dpkg           rPx -> child-dpkg,
-  /{usr/,}bin/echo           rix,
-  /{usr/,}bin/gdbus          rix,
-  /{usr/,}bin/ischroot       rix,
-  /{usr/,}bin/test           rix,
-  /{usr/,}bin/touch          rix,
-  /{usr/,}lib/apt/methods/*  rPx,
-  /{usr/,}lib/cnf-update-db  rPx,
-  /{usr/,}lib/update-notifier/update-motd-updates-available  rPx,
-
-  /usr/share/dpkg/tupletable r,
-  /usr/share/dpkg/cputable r,
-
-  /etc/PackageKit/PackageKit.conf r,
-
-  /etc/machine-id r,
-  /var/lib/dbus/machine-id r,
-
-  /var/cache/apt/ r,
-  /var/cache/apt/** rwk,
-  /var/cache/PackageKit/downloads/ r,
-
-  /var/lib/apt/lists/** rw,
-  /var/lib/apt/lists/lock rwk,
-  /var/lib/apt/periodic/update-success-stamp rw,
-  /var/lib/dpkg/info/{,*} r,
-  /var/lib/PackageKit/{,*} rw,
-  /var/lib/PackageKit/transactions.db rwk,
-
-  owner @{run}/systemd/users/@{uid} r,
-
-  owner @{PROC}/@{pid}/fd/ r,
-        @{PROC}/@{pids}/cgroup r,
-        @{PROC}/@{pids}/mountinfo r,
-
-  include if exists <local/packagekitd>
-}

apparmor.d/profiles-m-r/packagekitd

@@ -15,7 +15,14 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
   include <abstractions/ssl_certs>
   include if exists <abstractions/apt-common>
 
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability kill,
   capability net_admin,
+  capability setgid,
+  capability setuid,
   capability sys_nice,
 
   network inet stream,
@@ -24,13 +31,23 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
   network inet6 dgram,
   network netlink raw,
 
+  signal send set=int peer=apt-methods-*,
+
   dbus receive bus=system path=/org/freedesktop/PackageKit
        interface=org.freedesktop.DBus.Properties 
        peer=(name=:*, label=gnome-shell),
 
+  dbus receive bus=system path=/org/freedesktop/PackageKit
+       interface=org.freedesktop.{DBus.Introspectable,PackageKit}
+       member={Introspect,StateHasChanged}
+       peer=(name=:*, label=apt),
+
+  dbus (send,receive) bus=system path=/[0-9]*_@{hex}
+       interface=org.freedesktop.{DBus.Properties,PackageKit.Transaction},
+
   dbus send bus=system path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
-       member=RequestName
+       member={RequestName,GetConnectionUnixUser}
        peer=(name=org.freedesktop.DBus, label=dbus-daemon),
 
   dbus send bus=system path=/org/freedesktop/NetworkManager
@@ -40,10 +57,9 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
 
   dbus receive bus=system path=/org/freedesktop/NetworkManager
        interface=org.freedesktop.NetworkManager
-       member=CheckPermissions
+       member={CheckPermissions,DeviceAdded,DeviceRemoved,StateChanged}
        peer=(name=:*, label=NetworkManager),
 
-
   dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
        interface=org.freedesktop.DBus.Properties
        member=GetAll
@@ -54,26 +70,46 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
        member=Changed
        peer=(name=:*, label=polkitd),
 
-  dbus bind bus=system name= org.freedesktop.PackageKit,
+  dbus receive bus=system path=/org/freedesktop/login[0-9]
+       interface=org.freedesktop.login[0-9].Manager
+       member={SessionNew,PrepareForShutdown,SessionRemoved,UserNew,UserRemoved,PrepareForSleep}
+       peer=(name=:*, label=systemd-logind),
+
+  dbus bind bus=system 
+       name=org.freedesktop.PackageKit,
   
   @{exec_path} mr,
 
-  /{usr/,}bin/dpkg     rPx -> child-dpkg,
-
   /{usr/,}bin/gpg      rCx -> gpg,
   /{usr/,}bin/gpgconf  rCx -> gpg,
   /{usr/,}bin/gpgsm    rCx -> gpg,
 
-  /etc/pacman.conf r,
+  /{usr/,}{s,}bin/ldconfig   rix,
-  /etc/pacman.d//{,**} r,
+  /{usr/,}bin/{,ba,da}sh     rix,
-  /etc/PackageKit/{,**} r,
+  /{usr/,}bin/echo           rix,
+  /{usr/,}bin/gdbus          rix,
+  /{usr/,}bin/ischroot       rix,
+  /{usr/,}bin/test           rix,
+  /{usr/,}bin/touch          rix,
 
-  /var/cache/PackageKit/{,**} rw,
+  /{usr/,}bin/appstreamcli                rPx,
-  /var/cache/pacman/pkg/{,**} rw,
+  /{usr/,}bin/dpkg                        rPx -> child-dpkg,
-  /var/lib/PackageKit/{,**} rwk,
+  /{usr/,}bin/glib-compile-schemas        rPx,
-  /var/lib/pacman/{,**} rwk,
+  /{usr/,}bin/update-desktop-database     rPx,
-  /var/log/*PackageKit.log rw,
+  /{usr/,}lib/apt/methods/*               rPx,
-  /var/log/pacman.log rw,
+  /{usr/,}lib/cnf-update-db               rPx,
+  /{usr/,}lib/update-notifier/update-motd-updates-available  rPx,
+  /usr/share/libalpm/scripts/*            rPx,
+
+  # Install/update packages
+  / r,
+  /*{,/} rw,
+  /boot/** rwl -> /boot/**,
+  /etc/** rwl -> /etc/**,
+  /opt/** rwl -> /opt/**,
+  /srv/** rwl -> /srv/**,
+  /usr/** rwlk -> /usr/**,
+  /var/** rwlk -> /var/**,
 
   owner /tmp/packagekit* rw,
 
@@ -81,6 +117,7 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
   owner @{run}/systemd/users/@{uid} r,
 
         @{PROC}/@{pids}/cgroup r,
+        @{PROC}/@{pids}/mountinfo r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mounts r,
 

dists/flags/ubuntu.flags

@@ -9,7 +9,6 @@ list-oem-metapackages complain
 livepatch-notification complain
 notify-reboot-required complain
 package-system-locked attach_disconnected,complain
-packagekitd complain
 release-upgrade-motd complain
 software-properties-gtk
 software-properties-gtk complain