General update

apparmor.d/profiles-a-f/boltd

@@ -16,12 +16,32 @@ profile boltd @{exec_path} flags=(attach_disconnected) {
 
   network netlink raw,
 
+  dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
+      interface=org.freedesktop.DBus.Properties
+      member=GetAll,
+  
+  dbus send bus=system path=/org/freedesktop/DBus
+      interface=org.freedesktop.DBus
+      member=RequestName,
+  
+  dbus receive bus=system path=/org/freedesktop/bolt
+      interface=org.freedesktop.DBus.Properties
+      member=GetAll,
+  
+  dbus receive bus=system path=/org/freedesktop/bolt
+      interface=org.freedesktop.bolt1.Manager
+      member=ListDevices,
+  
+  dbus bind bus=system 
+      name=org.freedesktop.bolt,
+
   @{exec_path} mr,
 
   /var/lib/boltd/{,**} rw,
 
   owner @{run}/boltd/{,**} rw,
 
+  @{run}/systemd/notify
   @{run}/systemd/journal/socket w,
   @{run}/udev/data/+thunderbolt:* r,
 
@@ -37,7 +57,8 @@ profile boltd @{exec_path} flags=(attach_disconnected) {
   @{sys}/devices/pci[0-9]*/**/domain[0-9]*/**/{vendor,device}_name r,
   @{sys}/devices/pci[0-9]*/**/domain[0-9]*/iommu_dma_protection r,
   @{sys}/devices/platform/**/uevent r,
+  @{sys}/devices/platform/*/wmi_bus/wmi_bus-*/@{uuid}/force_power rw,
   @{sys}/devices/virtual/dmi/id/{sys_vendor,product_version,product_name} r,
 
   include if exists <local/boltd>
-}
+}

apparmor.d/profiles-a-f/dkms

@@ -1,6 +1,7 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
 # Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# Copyright (C) 2022 Jeroen Rijken
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -11,6 +12,7 @@ include <tunables/global>
 profile dkms @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
+  include <abstractions/nameservice-strict>
   include <abstractions/openssl>
 
   capability dac_read_search,
@@ -37,7 +39,7 @@ profile dkms @{exec_path} flags=(attach_disconnected) {
   /{usr/,}bin/rmdir      rix,
   /{usr/,}bin/find       rix,
   /{usr/,}bin/{,e}grep   rix,
-  /{usr/,}bin/gawk       rix,
+  /{usr/,}bin/{,g,m}awk  rix,
   /{usr/,}bin/cp         rix,
   /{usr/,}bin/date       rix,
   /{usr/,}bin/ln         rix,
@@ -62,6 +64,8 @@ profile dkms @{exec_path} flags=(attach_disconnected) {
   /{usr/,}lib/linux-kbuild-*/tools/objtool/objtool rix,
   /{usr/,}lib/modules/*/build/tools/objtool/objtool rix,
 
+  /var/lib/dkms/**/dkms.postbuild rix,
+
   / r,
   /{usr/,}lib/modules/*/updates/ rw,
   /{usr/,}lib/modules/*/updates/dkms/{,*,*/,**.ko.xz,**.ko.zst} rw,
@@ -106,6 +110,9 @@ profile dkms @{exec_path} flags=(attach_disconnected) {
 
     /{usr/,}bin/kmod mr,
 
+    /etc/depmod.d/{,ubuntu.conf} r,
+    /etc/ssl/openssl.cnf r,
+
     @{PROC}/cmdline r,
 
     /{usr/,}lib/modules/*/modules.* rw,

apparmor.d/profiles-a-f/dkms-autoinstaller

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2022 Jeroen Rijken
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -13,15 +14,13 @@ profile dkms-autoinstaller @{exec_path} {
 
   @{exec_path} r,
   /{usr/,}bin/{,ba,da}sh rix,
-
-  /{usr/,}bin/readlink   rix,
-  /{usr/,}bin/tput       rix,
+  /{usr/,}{s,}bin/dkms   rPx,
   /{usr/,}bin/echo       rix,
-
-  /{usr/,}{s,}bin/dkms      rPx,
-
+  /{usr/,}bin/plymouth   rix,
+  /{usr/,}bin/readlink   rix,
   /{usr/,}bin/run-parts  rCx -> run-parts,
   /{usr/,}bin/systemctl  rPx -> child-systemctl,
+  /{usr/,}bin/tput       rix,
 
   # For shell pwd
   / r,

apparmor.d/profiles-a-f/fwupdmgr

@@ -17,14 +17,40 @@ profile fwupdmgr @{exec_path} flags=(attach_disconnected,complain) {
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
 
+  capability sys_nice,
+
   signal (send),
 
+
+ALLOWED fwupdmgr dbus_method_call org.freedesktop.fwupd send bus=system path=/ interface=org.freedesktop.fwupd member=UpdateMetadata peer_label=unconfined
+
+
   network inet stream,
   network inet6 stream,
   network inet dgram,
   network inet6 dgram,
   network netlink raw,
 
+  dbus send bus=system path=/
+      interface=org.freedesktop.DBus.Properties
+      member=GetAll,
+  
+  dbus send bus=system path=/
+      interface=org.freedesktop.fwupd
+      member={GetDevices,GetPlugins,GetRemotes,SetFeatureFlags,SetHints,UpdateMetadata},
+  
+  dbus send bus=system path=/org/freedesktop/systemd[0-9]
+      interface=org.freedesktop.DBus.Properties
+      member=GetAll,
+  
+  dbus send bus=system path=/org/freedesktop/systemd[0-9]
+      interface=org.freedesktop.systemd[0-9].Manager
+      member={GetDefaultTarget,GetUnit},
+
+  dbus receive bus=system path=/
+      interface=org.freedesktop.fwupd
+      member=Changed,
+
   @{exec_path} mr,
 
   /{usr/,}bin/dbus-launch  rCx -> dbus,
@@ -38,6 +64,7 @@ profile fwupdmgr @{exec_path} flags=(attach_disconnected,complain) {
   owner /var/cache/private/fwupdmgr/fwupd/lvfs-metadata.xml.gz{,.asc} rw,
 
   owner @{user_cache_dirs}/ rw,
+        @{user_cache_dirs}/dconf/user rw,
   owner @{user_cache_dirs}/fwupd/ rw,
   owner @{user_cache_dirs}/fwupd/lvfs-metadata.xml.gz{,.*} rw,