feat(profiles): better ubuntu integration.

apparmor.d/groups/bus/ibus-daemon

@@ -45,8 +45,9 @@ profile ibus-daemon @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
   
-  /{usr/,}lib/ibus/ibus-*  rPx,
   @{libexec}/ibus-*        rPx,
+  /{usr/,}bin/{,ba,da}sh   rix,
+  /{usr/,}lib/ibus/ibus-*  rPx,
 
   /usr/share/ibus/{,**} r,
   /usr/share/ibus-table/tables/ r,

apparmor.d/groups/freedesktop/colord

@@ -44,6 +44,11 @@ profile colord @{exec_path} flags=(attach_disconnected) {
        member=GetAll
        peer=(name=:*, label="{gsd-color,colord-sane,gnome-control-center}"),
 
+  dbus send bus=system path=/org/freedesktop/ColorManager
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=:*, label=colord),
+
   dbus bind bus=system 
        name=org.freedesktop.ColorManager,
 

apparmor.d/groups/gnome/gnome-shell

@@ -198,6 +198,10 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
        member=JobRemoved
        peer=(name=:*),
 
+  dbus send bus=system path=/org/freedesktop/login[0-9]{,/**}
+       interface=org.freedesktop.{DBus.Properties,login[0-9].{Manager,Session}}
+       peer=(name=:*, label=systemd-logind),
+
   dbus send    bus=session path=/org/gnome/Mutter/DisplayConfig
        interface=org.gnome.Mutter.DisplayConfig
        member={GetResources,GetCrtcGamma}

apparmor.d/profiles-m-r/mission-control

@@ -14,8 +14,6 @@ profile mission-control @{exec_path} {
   network netlink raw,
 
   @{exec_path} mr,
-  @{libexec}/* rPUx,  # FIXME: Needed ?
-
   /usr/share/telepathy/{,**} r,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 

apparmor.d/profiles-m-r/packagekitd

@@ -6,12 +6,16 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-@{exec_path} = /{usr/,}lib/packagekitd
+@{exec_path} = @{libexec}/packagekitd
 profile packagekitd @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
-  include <abstractions/ssl_certs>
+  include <abstractions/dbus-strict>
   include <abstractions/nameservice-strict>
   include <abstractions/openssl>
+  include <abstractions/ssl_certs>
+  include if exists <abstractions/apt-common>
+
+  capability sys_nice,
 
   network inet stream,
   network inet6 stream,
@@ -19,8 +23,42 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
   network inet6 dgram,
   network netlink raw,
 
+  dbus receive bus=system path=/org/freedesktop/PackageKit
+       interface=org.freedesktop.DBus.Properties 
+       peer=(name=:*, label=gnome-shell),
+
+  dbus send bus=system path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus
+       member=RequestName
+       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
+
+  dbus send bus=system path=/org/freedesktop/NetworkManager
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=:*, label=NetworkManager),
+
+  dbus receive bus=system path=/org/freedesktop/NetworkManager
+       interface=org.freedesktop.NetworkManager
+       member=CheckPermissions
+       peer=(name=:*, label=NetworkManager),
+
+
+  dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=:*, label=polkitd),
+
+  dbus receive bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
+       interface=org.freedesktop.PolicyKit[0-9].Authority
+       member=Changed
+       peer=(name=:*, label=polkitd),
+
+  dbus bind bus=system name= org.freedesktop.PackageKit,
+  
   @{exec_path} mr,
 
+  /{usr/,}bin/dpkg     rPx -> child-dpkg,
+
   /{usr/,}bin/gpg      rCx -> gpg,
   /{usr/,}bin/gpgconf  rCx -> gpg,
   /{usr/,}bin/gpgsm    rCx -> gpg,
@@ -42,6 +80,7 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
   owner @{run}/systemd/users/@{uid} r,
 
         @{PROC}/@{pids}/cgroup r,
+  owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mounts r,
 
   profile gpg {

apparmor.d/profiles-s-z/snapd

@@ -27,6 +27,7 @@ profile snapd @{exec_path} {
   capability setgid,
   capability setuid,
   capability sys_admin,
+  capability sys_ptrace,
   capability sys_resource,
 
   network inet stream,
@@ -39,6 +40,7 @@ profile snapd @{exec_path} {
   umount /tmp/syscheck-mountpoint-[0-9]*/,
   umount /snap/*/[0-9]*/,
 
+  ptrace (read) peer=snap,
   ptrace (read) peer=unconfined,
 
   dbus send bus=system path=/org/freedesktop/timedate1