From 1aa0142a6aa0b31732fdf286fea14e3600b2f76e Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Thu, 29 May 2025 23:20:32 +0200
Subject: [PATCH] feat(fsp): add/update systemd drop in files with
 AppArmorProfile set to the target profile.

---
 systemd/full/system/apport-coredump-hook@.service  | 2 ++
 systemd/full/system/apt-news.service               | 2 ++
 systemd/full/system/bluetooth.service              | 2 +-
 systemd/full/system/cloud-init-hotplugd.service    | 2 ++
 systemd/full/system/colord.service                 | 2 ++
 systemd/full/system/debug-shell.service            | 2 ++
 systemd/full/system/dmesg.service                  | 2 ++
 systemd/full/system/fwupd.service                  | 2 ++
 systemd/full/system/grub-common.service            | 2 ++
 systemd/full/system/ldconfig.service               | 2 ++
 systemd/full/system/logrotate.service              | 2 ++
 systemd/full/system/low-memory-monitor.service     | 3 ---
 systemd/full/system/man-db.service                 | 2 ++
 systemd/full/system/paccache.service               | 2 --
 systemd/full/system/passim.service                 | 2 --
 systemd/full/system/pcscd.service                  | 2 ++
 systemd/full/system/power-profiles-daemon.service  | 2 ++
 systemd/full/system/reflector.service              | 2 --
 systemd/full/system/rsyslog.service                | 2 ++
 systemd/full/system/secureboot-db.service          | 2 ++
 systemd/full/system/shadow.service                 | 3 +--
 systemd/full/system/snapd.system-shutdown.service  | 2 ++
 systemd/full/system/system-update-cleanup.service  | 2 ++
 systemd/full/system/systemd-coredump@.service      | 2 ++
 systemd/full/system/systemd-initctl.service        | 2 ++
 systemd/full/system/systemd-journal-remote.service | 2 ++
 systemd/full/system/systemd-nsresourced.service    | 2 ++
 systemd/full/system/systemd-oomd.service           | 2 ++
 systemd/full/system/systemd-rfkill.service         | 2 ++
 systemd/full/system/systemd-timesyncd.service      | 2 ++
 systemd/full/system/usb_modeswitch@.service        | 2 ++
 31 files changed, 52 insertions(+), 12 deletions(-)
 create mode 100644 systemd/full/system/apport-coredump-hook@.service
 create mode 100644 systemd/full/system/apt-news.service
 create mode 100644 systemd/full/system/cloud-init-hotplugd.service
 create mode 100644 systemd/full/system/colord.service
 create mode 100644 systemd/full/system/debug-shell.service
 create mode 100644 systemd/full/system/dmesg.service
 create mode 100644 systemd/full/system/fwupd.service
 create mode 100644 systemd/full/system/grub-common.service
 create mode 100644 systemd/full/system/ldconfig.service
 create mode 100644 systemd/full/system/logrotate.service
 delete mode 100644 systemd/full/system/low-memory-monitor.service
 create mode 100644 systemd/full/system/man-db.service
 delete mode 100644 systemd/full/system/paccache.service
 delete mode 100644 systemd/full/system/passim.service
 create mode 100644 systemd/full/system/pcscd.service
 create mode 100644 systemd/full/system/power-profiles-daemon.service
 delete mode 100644 systemd/full/system/reflector.service
 create mode 100644 systemd/full/system/rsyslog.service
 create mode 100644 systemd/full/system/secureboot-db.service
 create mode 100644 systemd/full/system/snapd.system-shutdown.service
 create mode 100644 systemd/full/system/system-update-cleanup.service
 create mode 100644 systemd/full/system/systemd-coredump@.service
 create mode 100644 systemd/full/system/systemd-initctl.service
 create mode 100644 systemd/full/system/systemd-journal-remote.service
 create mode 100644 systemd/full/system/systemd-nsresourced.service
 create mode 100644 systemd/full/system/systemd-oomd.service
 create mode 100644 systemd/full/system/systemd-rfkill.service
 create mode 100644 systemd/full/system/systemd-timesyncd.service
 create mode 100644 systemd/full/system/usb_modeswitch@.service

diff --git a/systemd/full/system/apport-coredump-hook@.service b/systemd/full/system/apport-coredump-hook@.service
new file mode 100644
index 000000000..73bbc99d8
--- /dev/null
+++ b/systemd/full/system/apport-coredump-hook@.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&apport
\ No newline at end of file
diff --git a/systemd/full/system/apt-news.service b/systemd/full/system/apt-news.service
new file mode 100644
index 000000000..d7bf885dd
--- /dev/null
+++ b/systemd/full/system/apt-news.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&apt_news
diff --git a/systemd/full/system/bluetooth.service b/systemd/full/system/bluetooth.service
index 03d352890..5cccff422 100644
--- a/systemd/full/system/bluetooth.service
+++ b/systemd/full/system/bluetooth.service
@@ -1,2 +1,2 @@
 [Service]
-NoNewPrivileges=no
\ No newline at end of file
+AppArmorProfile=&bluetoothd
\ No newline at end of file
diff --git a/systemd/full/system/cloud-init-hotplugd.service b/systemd/full/system/cloud-init-hotplugd.service
new file mode 100644
index 000000000..a2a121fc3
--- /dev/null
+++ b/systemd/full/system/cloud-init-hotplugd.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&cloud-init-hotplugd.service
diff --git a/systemd/full/system/colord.service b/systemd/full/system/colord.service
new file mode 100644
index 000000000..9a64fbc26
--- /dev/null
+++ b/systemd/full/system/colord.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&colord
diff --git a/systemd/full/system/debug-shell.service b/systemd/full/system/debug-shell.service
new file mode 100644
index 000000000..f895f7941
--- /dev/null
+++ b/systemd/full/system/debug-shell.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=debug-shell.service
\ No newline at end of file
diff --git a/systemd/full/system/dmesg.service b/systemd/full/system/dmesg.service
new file mode 100644
index 000000000..d4647117b
--- /dev/null
+++ b/systemd/full/system/dmesg.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=dmesg.service
\ No newline at end of file
diff --git a/systemd/full/system/fwupd.service b/systemd/full/system/fwupd.service
new file mode 100644
index 000000000..5054a73d6
--- /dev/null
+++ b/systemd/full/system/fwupd.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&fwupd
\ No newline at end of file
diff --git a/systemd/full/system/grub-common.service b/systemd/full/system/grub-common.service
new file mode 100644
index 000000000..8520aea76
--- /dev/null
+++ b/systemd/full/system/grub-common.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=grub-common.service
\ No newline at end of file
diff --git a/systemd/full/system/ldconfig.service b/systemd/full/system/ldconfig.service
new file mode 100644
index 000000000..1b2a9c287
--- /dev/null
+++ b/systemd/full/system/ldconfig.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=ldconfig.service
\ No newline at end of file
diff --git a/systemd/full/system/logrotate.service b/systemd/full/system/logrotate.service
new file mode 100644
index 000000000..bc984e025
--- /dev/null
+++ b/systemd/full/system/logrotate.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&logrotate
\ No newline at end of file
diff --git a/systemd/full/system/low-memory-monitor.service b/systemd/full/system/low-memory-monitor.service
deleted file mode 100644
index dabf76f3a..000000000
--- a/systemd/full/system/low-memory-monitor.service
+++ /dev/null
@@ -1,3 +0,0 @@
-[Service]
-NoNewPrivileges=no
-
diff --git a/systemd/full/system/man-db.service b/systemd/full/system/man-db.service
new file mode 100644
index 000000000..d3a78dd80
--- /dev/null
+++ b/systemd/full/system/man-db.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=man-db.service
\ No newline at end of file
diff --git a/systemd/full/system/paccache.service b/systemd/full/system/paccache.service
deleted file mode 100644
index 03d352890..000000000
--- a/systemd/full/system/paccache.service
+++ /dev/null
@@ -1,2 +0,0 @@
-[Service]
-NoNewPrivileges=no
\ No newline at end of file
diff --git a/systemd/full/system/passim.service b/systemd/full/system/passim.service
deleted file mode 100644
index 03d352890..000000000
--- a/systemd/full/system/passim.service
+++ /dev/null
@@ -1,2 +0,0 @@
-[Service]
-NoNewPrivileges=no
\ No newline at end of file
diff --git a/systemd/full/system/pcscd.service b/systemd/full/system/pcscd.service
new file mode 100644
index 000000000..8d39f3f26
--- /dev/null
+++ b/systemd/full/system/pcscd.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&pcscd
diff --git a/systemd/full/system/power-profiles-daemon.service b/systemd/full/system/power-profiles-daemon.service
new file mode 100644
index 000000000..45c5ed93b
--- /dev/null
+++ b/systemd/full/system/power-profiles-daemon.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&power-profiles-daemon
\ No newline at end of file
diff --git a/systemd/full/system/reflector.service b/systemd/full/system/reflector.service
deleted file mode 100644
index 03d352890..000000000
--- a/systemd/full/system/reflector.service
+++ /dev/null
@@ -1,2 +0,0 @@
-[Service]
-NoNewPrivileges=no
\ No newline at end of file
diff --git a/systemd/full/system/rsyslog.service b/systemd/full/system/rsyslog.service
new file mode 100644
index 000000000..6b49a73f0
--- /dev/null
+++ b/systemd/full/system/rsyslog.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&rsyslogd
diff --git a/systemd/full/system/secureboot-db.service b/systemd/full/system/secureboot-db.service
new file mode 100644
index 000000000..722781b8a
--- /dev/null
+++ b/systemd/full/system/secureboot-db.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=secureboot-db.service
diff --git a/systemd/full/system/shadow.service b/systemd/full/system/shadow.service
index dabf76f3a..52d2f644c 100644
--- a/systemd/full/system/shadow.service
+++ b/systemd/full/system/shadow.service
@@ -1,3 +1,2 @@
 [Service]
-NoNewPrivileges=no
-
+AppArmorProfile=&shadow.service
diff --git a/systemd/full/system/snapd.system-shutdown.service b/systemd/full/system/snapd.system-shutdown.service
new file mode 100644
index 000000000..7953d522a
--- /dev/null
+++ b/systemd/full/system/snapd.system-shutdown.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=snapd.system-shutdown.service
\ No newline at end of file
diff --git a/systemd/full/system/system-update-cleanup.service b/systemd/full/system/system-update-cleanup.service
new file mode 100644
index 000000000..24c914f77
--- /dev/null
+++ b/systemd/full/system/system-update-cleanup.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=system-update-cleanup.service
\ No newline at end of file
diff --git a/systemd/full/system/systemd-coredump@.service b/systemd/full/system/systemd-coredump@.service
new file mode 100644
index 000000000..d13624709
--- /dev/null
+++ b/systemd/full/system/systemd-coredump@.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&systemd-coredump
diff --git a/systemd/full/system/systemd-initctl.service b/systemd/full/system/systemd-initctl.service
new file mode 100644
index 000000000..e44c8767f
--- /dev/null
+++ b/systemd/full/system/systemd-initctl.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&systemd-initctl
\ No newline at end of file
diff --git a/systemd/full/system/systemd-journal-remote.service b/systemd/full/system/systemd-journal-remote.service
new file mode 100644
index 000000000..e08cf75a9
--- /dev/null
+++ b/systemd/full/system/systemd-journal-remote.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&systemd-journal-remote
\ No newline at end of file
diff --git a/systemd/full/system/systemd-nsresourced.service b/systemd/full/system/systemd-nsresourced.service
new file mode 100644
index 000000000..2dc668b80
--- /dev/null
+++ b/systemd/full/system/systemd-nsresourced.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&systemd-nsresourced
diff --git a/systemd/full/system/systemd-oomd.service b/systemd/full/system/systemd-oomd.service
new file mode 100644
index 000000000..c384626ee
--- /dev/null
+++ b/systemd/full/system/systemd-oomd.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&systemd-oomd
diff --git a/systemd/full/system/systemd-rfkill.service b/systemd/full/system/systemd-rfkill.service
new file mode 100644
index 000000000..4abf222d5
--- /dev/null
+++ b/systemd/full/system/systemd-rfkill.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&systemd-rfkill
diff --git a/systemd/full/system/systemd-timesyncd.service b/systemd/full/system/systemd-timesyncd.service
new file mode 100644
index 000000000..0cd6fefbf
--- /dev/null
+++ b/systemd/full/system/systemd-timesyncd.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=&systemd-timesyncd
diff --git a/systemd/full/system/usb_modeswitch@.service b/systemd/full/system/usb_modeswitch@.service
new file mode 100644
index 000000000..0eca1db25
--- /dev/null
+++ b/systemd/full/system/usb_modeswitch@.service
@@ -0,0 +1,2 @@
+[Service]
+AppArmorProfile=usb_modeswitch.service
\ No newline at end of file