update

apparmor.d/profiles-s-z/su

@@ -77,13 +77,13 @@ profile su @{exec_path} {
 
   dbus (send)
     bus=system
-    path=/org/freedesktop/login[1-9]
-    interface=org.freedesktop.login[1-9].Manager
+    path=/org/freedesktop/login[0-9]
+    interface=org.freedesktop.login[0-9].Manager
     member={CreateSession,ReleaseSession},
 
   unix (bind) type=dgram,
 
-  owner /dev/tty[0-9]* rw,
+  /dev/tty[0-9]* rw,
 
   include if exists <local/su>
 }

apparmor.d/profiles-s-z/sudo

@@ -1,11 +1,14 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
 
 include <tunables/global>
 
+@{PATH} = /usr/local/sbin /usr/local/bin /usr/sbin /usr/bin /sbin /bin
+
 @{exec_path} = /{usr/,}bin/sudo
 profile sudo @{exec_path} {
   include <abstractions/base>
@@ -27,27 +30,30 @@ profile sudo @{exec_path} {
   capability sys_resource,
 
   network netlink raw,
+  # dns query?
+#  network inet dgram,
+#  network inet6 dgram,
 
   ptrace (read),
   signal,
   signal (send) set=(cont,hup) peer=su,
 
   @{exec_path} mr,
+  @{libexec}/sudo/** mr,
 
   # Shells to use
   /{usr/,}bin/{,b,d,rb}ash rpux,
   /{usr/,}bin/{c,k,tc,z}sh rpux,
 
-  /{usr/,}bin/[a-z0-9]*               rPUx,
-  /{usr/,}{s,}bin/[a-z0-9]*           rPUx,
+  @{PATH}/[a-z0-9]*                   rPUx,
   /{usr/,}lib/cockpit/cockpit-askpass rPUx,
 
+  /etc/environment r,
+  /etc/machine-id r,
+  /etc/security/limits.d/{,*} r,
   /etc/sudo.conf r,
-
   /etc/sudoers r,
   /etc/sudoers.d/{,*} r,
-  /etc/environment r,
-  /etc/security/limits.d/{,*} r,
   /etc/default/locale r,
 
   /var/log/sudo.log wk,
@@ -60,11 +66,14 @@ profile sudo @{exec_path} {
 
   @{PROC}/@{pids}/fd/ r,
   @{PROC}/@{pids}/stat r,
+  @{PROC}/1/limits r,
 
   # File Inherit
-  owner /dev/tty[0-9]* rw,
+  owner  /dev/tty[0-9]* rw,
   owner @{HOME}/.xsession-errors w,
 
+  /var/lib/sudo/lectured/user rw,
+
   owner @{HOME}/.sudo_as_admin_successful rw,
 
   @{run}/systemd/userdb/ r,
@@ -72,7 +81,7 @@ profile sudo @{exec_path} {
 
   @{PROC}/sys/kernel/random/boot_id r,
 
-#  /dev/ r,  # noise
+  /dev/ r,    # interactive login
   /dev/ptmx rw,
 
   include if exists <local/sudo>