feat: update profiles.

apparmor.d/groups/apt/apt

@@ -8,7 +8,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}bin/apt
-profile apt @{exec_path} flags=(complain) {
+profile apt @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/apt-common>
   include <abstractions/consoles>
@@ -84,6 +84,7 @@ profile apt @{exec_path} flags=(complain) {
   # For package building
   @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
 
+  @{run}/systemd/inhibit/[0-9]*.ref rw,
 
   profile editor flags=(complain) {
     include <abstractions/base>

apparmor.d/groups/apt/dpkg-status

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}lib/needrestart/dpkg-status
 profile dpkg-status @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
 
   @{exec_path} mr,
 

apparmor.d/groups/apt/unattended-upgrade

@@ -24,11 +24,12 @@ profile unattended-upgrade @{exec_path} {
 
   /{usr/,}bin/ r,
 
-  /{usr/,}bin/dpkg            rPx,
-  /{usr/,}bin/lsb_release     rPx -> lsb_release,
-  /{usr/,}bin/python3.[0-9]*  rix,
-  /{usr/,}bin/uname           rix,
-  /{usr/,}lib/apt/methods/http{,s} rPx,
+  /{usr/,}{s,}bin/on_ac_power       rPx,
+  /{usr/,}bin/dpkg                  rPx,
+  /{usr/,}bin/lsb_release           rPx -> lsb_release,
+  /{usr/,}bin/python3.[0-9]*        rix,
+  /{usr/,}bin/uname                 rix,
+  /{usr/,}lib/apt/methods/http{,s}  rPx,
 
   /usr/share/dpkg/*table r,
 
@@ -43,9 +44,11 @@ profile unattended-upgrade @{exec_path} {
 
   /var/lib/apt/extended_states r,
   /var/lib/apt/lists/{,**} r,
+  /var/lib/apt/periodic/unattended-upgrades-stamp w,
   /var/lib/dpkg/lock rwk,
   /var/lib/dpkg/lock-frontend rwk,
   /var/lib/dpkg/status r,
+  /var/lib/dpkg/updates/ r,
 
   /var/cache/apt/archives/{,**} rw,
   /var/cache/apt/pkgcache.bin r,

apparmor.d/groups/apt/unattended-upgrade-shutdown

@@ -17,10 +17,12 @@ profile unattended-upgrade-shutdown @{exec_path} flags=(attach_disconnected) {
   /usr/share/unattended-upgrades/{,*} r,
   /etc/apt/apt.conf.d/{,*} r,
 
-  owner /var/log/unattended-upgrades/*.log rw,
+  owner /var/log/unattended-upgrades/*.log* rw,
 
   owner @{run}/unattended-upgrades.lock rwk,
   owner @{run}/systemd/inhibit/[0-9]*.ref rw,
 
+  owner @{PROC}/@{pid}/mounts r,
+
   include if exists <local/unattended-upgrade-shutdown>
 }