feat(profile): update some core profiles.

apparmor.d/groups/freedesktop/polkitd

@@ -53,6 +53,8 @@ profile polkitd @{exec_path} flags=(attach_disconnected) {
         /var/lib/polkit{,-1}/localauthority/{,**} r,
   owner /var/lib/polkit{,-1}/.cache/ rw,
 
+  @{att}/@{run}/systemd/userdb/io.systemd.DynamicUser rw,
+
   @{run}/systemd/sessions/* r,
   @{run}/systemd/users/@{uid} r,
 

apparmor.d/groups/freedesktop/upower

@@ -10,6 +10,8 @@ include <tunables/global>
 @{exec_path} = @{bin}/upower
 profile upower @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-system>
+  include <abstractions/consoles>
 
   # Needed?
   audit capability sys_nice,

apparmor.d/groups/freedesktop/xdg-permission-store

@@ -43,6 +43,7 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) {
   owner @{user_share_dirs}/flatpak/db/ rw,
   owner @{user_share_dirs}/flatpak/db/.goutputstream-@{rand6} rw,
   owner @{user_share_dirs}/flatpak/db/background rw,
+  owner @{user_share_dirs}/flatpak/db/desktop-used-apps r,
   owner @{user_share_dirs}/flatpak/db/devices rw,
   owner @{user_share_dirs}/flatpak/db/documents rw,
   owner @{user_share_dirs}/flatpak/db/notifications rw,

apparmor.d/groups/network/netplan.script

@@ -49,6 +49,8 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) {
 
     capability net_admin,
 
+    @{att}/@{run}/systemd/private rw,
+
     include if exists <local/netplan.script_systemctl>
   }
 

apparmor.d/groups/ubuntu/apport

@@ -22,9 +22,7 @@ profile apport @{exec_path} flags=(attach_disconnected) {
   capability setuid,
   capability sys_ptrace,
 
-  ptrace (read) peer=gnome-shell,
+  ptrace read,
-  ptrace (read) peer=snap.cups.cupsd,
-  ptrace (read) peer=tracker-extract,
 
   @{exec_path} mr,
 
@@ -36,6 +34,10 @@ profile apport @{exec_path} flags=(attach_disconnected) {
   /usr/share/apport/{,**} r,
 
   /etc/apport/report-ignore/{,**} r,
+  /etc/login.defs r,
+
+  /var/lib/dpkg/info/ r,
+  /var/lib/dpkg/info/*.list r,
 
         /var/crash/ rw,
         /var/crash/*.@{uid}.crash rw,

apparmor.d/groups/virt/containerd

@@ -83,6 +83,8 @@ profile containerd @{exec_path} flags=(attach_disconnected) {
   @{run}/docker/containerd/{,**} rwk,
   @{run}/netns/ w,
   @{run}/netns/cni-@{uuid} rw,
+  @{run}/nri/ w,
+  @{run}/nri/nri.sock rw,
   @{run}/systemd/notify w,
 
         /tmp/cri-containerd.apparmor.d@{int} rwl,
@@ -94,12 +96,13 @@ profile containerd @{exec_path} flags=(attach_disconnected) {
   @{sys}/kernel/security/apparmor/profiles r,
   @{sys}/module/apparmor/parameters/enabled r,
 
+        @{PROC}/@{pid}/task/@{tid}/mountinfo r,
         @{PROC}/@{pid}/task/@{tid}/ns/net rw,
         @{PROC}/sys/net/core/somaxconn r,
-  owner @{PROC}/@{pids}/attr/current r,
+  owner @{PROC}/@{pid}/attr/current r,
-  owner @{PROC}/@{pids}/cgroup r,
+  owner @{PROC}/@{pid}/cgroup r,
-  owner @{PROC}/@{pids}/mountinfo r,
+  owner @{PROC}/@{pid}/mountinfo r,
-  owner @{PROC}/@{pids}/uid_map r,
+  owner @{PROC}/@{pid}/uid_map r,
 
   /dev/bsg/ r,
   /dev/bus/ r,

apparmor.d/profiles-a-f/chsh

@@ -10,6 +10,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/chsh
 profile chsh @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
   include <abstractions/authentication>
   include <abstractions/nameservice-strict>
   include <abstractions/wutmp>

apparmor.d/profiles-s-z/snap

@@ -29,6 +29,7 @@ profile snap @{exec_path} {
   mount options=(ro, silent) -> /tmp/snapd-auto-import-mount-@{int}/,
 
   #aa:dbus own bus=session name=io.snapcraft.Launcher
+  #aa:dbus own bus=session name=io.snapcraft.SessionAgent
   #aa:dbus own bus=session name=io.snapcraft.Settings
 
   #aa:dbus talk bus=session name=org.freedesktop.systemd1 label="@{p_systemd_user}"
@@ -45,6 +46,7 @@ profile snap @{exec_path} {
   @{bin}/gpg{,2}          rCx -> gpg,
   @{bin}/systemctl        rCx -> systemctl,
 
+  @{lib_dirs}/**          mr,
   @{lib_dirs}/snapd/snap-confine     rPx,
   @{lib_dirs}/snapd/snap-seccomp     rPx,
   @{lib_dirs}/snapd/snapd            rPx,
@@ -108,6 +110,9 @@ profile snap @{exec_path} {
 
     network unix stream,
 
+    owner @{run}/user/@{uid}/systemd/notify rw,
+    owner @{run}/user/@{uid}/systemd/private rw,
+
     include if exists <local/snap_systemctl>
   }
 

apparmor.d/profiles-s-z/snap-update-ns

@@ -23,11 +23,17 @@ profile snap-update-ns @{exec_path} {
   mount -> /tmp/.snap/**,
   mount -> /usr/**,
   mount -> /var/lib/dhcp/,
+
   umount /snap/**,
   umount /var/lib/dhcp/,
+  umount @{lib}/@{multiarch}/webkit2gtk-@{version}/,
+  umount /usr/share/xml/iso-codes/,          
 
   @{exec_path} mr,
 
+  @{lib}/@{multiarch}/webkit2gtk-@{version}/ w,
+  /usr/share/xml/iso-codes/ w,
+
   /var/lib/snapd/mount/{,*} r,
 
   / r,

apparmor.d/profiles-s-z/snapd-apparmor

@@ -17,6 +17,7 @@ profile snapd-apparmor @{exec_path} {
   @{bin}/systemd-detect-virt         rPx,
   @{bin}/apparmor_parser             rPx,
 
+  @{lib_dirs}/** mr,
   @{lib_dirs}/snapd/apparmor_parser  rPx -> apparmor_parser,
   @{lib_dirs}/snapd/info r,
 

apparmor.d/profiles-s-z/uuidd

@@ -17,6 +17,7 @@ profile uuidd @{exec_path} flags=(attach_disconnected) {
 
   owner /var/lib/libuuid/clock.txt rwk,
 
+  @{run}/uuidd/request w,
   @{att}/@{run}/uuidd/request w,
 
   include if exists <local/uuidd>