feat(profile): restrict some access to @{PROC}/@{pid}.

apparmor.d/abstractions/app/chromium

@@ -182,14 +182,15 @@
 
         @{PROC}/ r,
         @{PROC}/@{pid}/fd/ r,
-        @{PROC}/@{pids}/stat r,
-        @{PROC}/@{pids}/statm r,
-        @{PROC}/@{pids}/task/@{tid}/stat r,
-        @{PROC}/@{pids}/task/@{tid}/status r,
+        @{PROC}/@{pid}/stat r,
+        @{PROC}/@{pid}/task/@{tid}/status r,
         @{PROC}/pressure/{memory,cpu,io} r,
         @{PROC}/sys/fs/inotify/max_user_watches r,
         @{PROC}/sys/kernel/yama/ptrace_scope r,
         @{PROC}/vmstat r,
+  owner @{PROC}/@{pid}/clear_refs w,
+  owner @{PROC}/@{pid}/cmdline r,
+  owner @{PROC}/@{pid}/environ r,
   owner @{PROC}/@{pid}/gid_map w,
   owner @{PROC}/@{pid}/limits r,
   owner @{PROC}/@{pid}/mem r,
@@ -197,12 +198,11 @@
   owner @{PROC}/@{pid}/mounts r,
   owner @{PROC}/@{pid}/oom_{,score_}adj rw,
   owner @{PROC}/@{pid}/setgroups w,
+  owner @{PROC}/@{pid}/statm r,
+  owner @{PROC}/@{pid}/task/ r,
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,
+  owner @{PROC}/@{pid}/task/@{tid}/stat r,
   owner @{PROC}/@{pid}/uid_map w,
-  owner @{PROC}/@{pids}/clear_refs w,
-  owner @{PROC}/@{pids}/cmdline r,
-  owner @{PROC}/@{pids}/environ r,
-  owner @{PROC}/@{pids}/task/ r,
 
         /dev/ r,
         /dev/hidraw@{int} rw,

apparmor.d/groups/bus/dbus-accessibility

@@ -64,12 +64,13 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) {
   @{sys}/kernel/security/apparmor/features/dbus/mask r,
   @{sys}/module/apparmor/parameters/enabled r,
 
-        @{PROC}/@{pid}/attr/apparmor/current r,
-        @{PROC}/@{pid}/cgroup r,
-        @{PROC}/@{pid}/cmdline r,
-        @{PROC}/@{pid}/oom_score_adj r,
+        @{PROC}/1/cgroup r,
+  owner @{PROC}/@{pid}/attr/apparmor/current r,
+  owner @{PROC}/@{pid}/cgroup r,
+  owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mounts r,
+  owner @{PROC}/@{pid}/oom_score_adj r,
 
   owner /dev/tty@{int} rw,
 

apparmor.d/groups/gnome/gnome-session-binary

@@ -91,9 +91,10 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
 
   @{sys}/devices/**/{vendor,device} r,
 
-        @{PROC}/@{pid}/cgroup r,
+        @{PROC}/1/cgroup r,
         @{PROC}/cmdline r,
         @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r,
+  owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/loginuid r,

apparmor.d/groups/gnome/gnome-shell

@@ -347,23 +347,23 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/cpu.max r,
 
         @{PROC}/ r,
-        @{PROC}/@{pid}/attr/current r,
-        @{PROC}/@{pid}/cgroup r,
+        @{PROC}/@{pid}/cmdline r,
         @{PROC}/@{pid}/net/* r,
-        @{PROC}/@{pid}/stat r,
-        @{PROC}/@{pid}/task/@{tid}/stat r,
-        @{PROC}/@{pids}/cmdline r,
         @{PROC}/1/cgroup r,
         @{PROC}/cmdline r,
         @{PROC}/sys/kernel/osrelease r,
         @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r,
         @{PROC}/vmstat r,
+  owner @{PROC}/@{pid}/attr/current r,
+  owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/fdinfo/@{int} r,
   owner @{PROC}/@{pid}/mountinfo r,
   owner @{PROC}/@{pid}/mounts r,
+  owner @{PROC}/@{pid}/stat r,
   owner @{PROC}/@{pid}/task/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,
+  owner @{PROC}/@{pid}/task/@{tid}/stat r,
 
   /dev/input/event@{int} rw,
   /dev/media@{int} rw,

apparmor.d/groups/gnome/gnome-software

@@ -117,10 +117,11 @@ profile gnome-software @{exec_path} {
 
   @{sys}/module/nvidia/version r,
 
-        @{PROC}/@{pid}/cgroup r,
         @{PROC}/@{pids}/mounts r,
+        @{PROC}/1/cgroup r,
         @{PROC}/sys/fs/pipe-max-size r,
         @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
+  owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/fdinfo/@{int} r,
   owner @{PROC}/@{pid}/stat r,

apparmor.d/groups/gnome/gsd-datetime

@@ -43,6 +43,9 @@ profile gsd-datetime @{exec_path} flags=(attach_disconnected) {
 
   @{run}/systemd/sessions/@{int} r,
   @{run}/systemd/users/@{uid} r,
+
+        @{PROC}/1/cgroup r,
+  owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/fdinfo/@{int} r,
   owner @{PROC}/@{pid}/stat r,
 

apparmor.d/groups/gnome/gsd-sharing

@@ -41,7 +41,8 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
   @{run}/systemd/sessions/* r,
   @{run}/systemd/users/@{uid} r,
 
-  @{PROC}/@{pid}/cgroup r,
+        @{PROC}/1/cgroup r,
+  owner @{PROC}/@{pid}/cgroup r,
 
   owner /dev/tty@{int} rw,
 

apparmor.d/groups/gnome/org.gnome.NautilusPreviewer

@@ -43,9 +43,10 @@ profile org.gnome.NautilusPreviewer @{exec_path} {
   @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*org.gnome.NautilusPreviewer.slice/*/memory.* r,
   @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/dbus.service/memory.* r,
 
+        @{PROC}/1/cgroup r,
         @{PROC}/devices r,
-        @{PROC}/@{pid}/cgroup r,
         @{PROC}/zoneinfo r,
+  owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/mounts r,
   owner @{PROC}/@{pid}/stat r,

apparmor.d/profiles-a-f/alacarte

@@ -30,6 +30,7 @@ profile alacarte @{exec_path} {
 
   owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw,
 
+  owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/mounts r,
 
   include if exists <local/alacarte>

apparmor.d/profiles-m-r/protonmail-bridge-core

@@ -44,8 +44,8 @@ profile protonmail-bridge-core @{exec_path} {
   owner /var/tmp/etilqs_@{hex16} rw,
 
   @{PROC}/ r,
+  @{PROC}/1/cgroup r,
   @{PROC}/sys/net/core/somaxconn r,
-  @{PROC}/@{pid}/cgroup r,
 
   deny @{bin}/pass x,
   deny owner @{user_password_store_dirs}/** r,