Add profiles for whoami, whereis, which, findmnt, users, sanoid and syncoid.

apparmor.d/profiles-a-f/findmnt

@@ -0,0 +1,22 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Jeroen Rijken
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/findmnt
+profile findmnt @{exec_path} flags=(complain) {
+  include <abstractions/base>
+  include <abstractions/consoles>
+
+  @{exec_path} mr,
+
+  /etc/fstab r,
+  /etc/mtab r,
+  
+  @{PROC}/@{pids}/mountinfo r,
+
+  include if exists <local/findmnt>
+}

apparmor.d/profiles-s-z/sanoid

@@ -0,0 +1,32 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Jeroen Rijken
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}{local/,}{s,}bin/sanoid
+profile sanoid @{exec_path} flags=(complain) {
+  include <abstractions/base>
+  include <abstractions/perl>
+
+  @{exec_path}                 rm,
+  /{usr/,}bin/{,ba,da}sh       rix,
+  /{usr/,}bin/perl             rix,
+  /{usr/,}bin/ps               rPx,
+  /{usr/,}{local/,}{s,}bin/zfs rPx,
+
+  /etc/sanoid/{*,} r,
+
+  /var/cache/sanoid/snapshots.txt rw,
+
+  /usr/share/sanoid/{**,} r,
+
+  @{run}/sanoid/sanoid_cacheupdate.lock rwk,
+  @{run}/sanoid/sanoid_pruning.lock rwk,
+
+  owner /tmp/** rw,
+
+  include if exists <local/sanoid>
+}

apparmor.d/profiles-s-z/syncoid

@@ -0,0 +1,32 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Jeroen Rijken
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}{local/,}{s,}bin/syncoid
+profile syncoid @{exec_path} flags=(complain) {
+  include <abstractions/base>
+  include <abstractions/consoles>
+  include <abstractions/perl>
+
+  @{exec_path}                   rm,
+  /{usr/,}bin/grep               rix,
+  /{usr/,}bin/mbuffer            rix,
+  /{usr/,}bin/perl               rix,
+  /{usr/,}bin/ps                 rPx,
+  /{usr/,}bin/pv                 rix,
+  /{usr/,}bin/{,ba,da}sh         rix,
+  /{usr/,}{local/,}{s,}bin/zfs   rPx,
+  /{usr/,}{local/,}{s,}bin/zpool rPx,
+
+  /etc/mbuffer.rc r,
+
+  owner /tmp/** rw,
+
+  @{PROC}/@{pids}/maps r,
+
+  include if exists <local/syncoid>
+}

apparmor.d/profiles-s-z/users

@@ -0,0 +1,22 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Jeroen Rijken
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/users
+profile users @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+  include <abstractions/nameservice-strict>
+
+  @{exec_path} mr,
+
+  /var/log/wtmp rk,
+
+  @{run}/utmp rk,
+
+  include if exists <local/users>
+}

apparmor.d/profiles-s-z/whereis

@@ -0,0 +1,43 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Jeroen Rijken
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/whereis
+profile whereis @{exec_path} flags=(complain) {
+  include <abstractions/base>
+  include <abstractions/consoles>
+
+  @{exec_path} mr,
+
+  /{usr/,}{local/,}{s,}bin/ r,
+  /{usr/,}lib/go-*/bin/ r,
+  /{usr/,}{local/,}games/ r,
+
+  /etc/ r,
+
+  /{usr/,}lib{,32,64}/ r,
+  /usr/local/{,etc/,lib/} r,
+  /usr/include/ r,
+  /usr/share/ r,
+  /usr/share/info/{**,} r,
+  /usr/share/man/{**,} r,
+  /usr/src/{**,} r,
+
+  @{libexec}/ r,
+
+  /opt/ r,
+  /opt/cni/bin/ r,
+  /opt/containerd/bin/ r,
+
+  /snap/bin/ r,
+
+  owner @{HOME}/{.local/,}/{.,}bin/ r,
+  owner @{HOME}/.krew/bin/ r,
+  owner @{HOME}/go/bin/ r,
+
+  include if exists <local/whereis>
+}

apparmor.d/profiles-s-z/which

@@ -0,0 +1,29 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Jeroen Rijken
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/which{.debianutils,} 
+profile which @{exec_path} flags=(complain) {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  /{usr/,}{local/,}{s,}bin/ r,
+  /{usr/,}lib/go-*/bin/ r,
+  /{usr/,}{local/,}games/ r,
+
+  /opt/cni/bin/ r,
+  /opt/containerd/bin/ r,
+
+  /snap/bin/ r,
+
+  owner @{HOME}/{.local/,}/{.,}bin/ r,
+  owner @{HOME}/.krew/bin/ r,
+  owner @{HOME}/go/bin/ r,
+
+  include if exists <local/which>
+}

apparmor.d/profiles-s-z/whoami

@@ -0,0 +1,18 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2019-2021 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/whoami
+profile whoami @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+  include <abstractions/nameservice-strict>
+
+  @{exec_path} mr,
+
+  include if exists <local/whoami>
+}