feat(profiles): general update.

apparmor.d/profiles-m-r/needrestart

@@ -49,10 +49,12 @@ profile needrestart @{exec_path} flags=(attach_disconnected) {
   /etc/needrestart/*.d/* rix,
   /etc/shadow r,
 
+  / r,
   /boot/ r,
   /boot/intel-ucode.img r,
   /boot/vmlinuz* r,
 
+  owner /var/lib/juju/agents/{,**} r,
   owner /var/cache/debconf/{config,passwords,templates}.dat{,-new,-old} rwk,
 
         @{PROC}/ r,

apparmor.d/profiles-m-r/newgrp

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2020-2021 Mikhail Morfikov
+# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -9,26 +10,19 @@ include <tunables/global>
 @{exec_path} = @{bin}/newgrp
 profile newgrp @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
   include <abstractions/nameservice-strict>
 
-  # To write records to the kernel auditing log.
   capability audit_write,
-
-  # To remove the following errors:
-  #  setgroups: Operation not permitted
-  #  setgid: Operation not permitted
   capability setgid,
-
-  # newgrp is a SETUID binary
   capability setuid,
 
   network netlink raw,
 
   @{exec_path} mr,
 
-  # Shells to use
-  @{bin}/{,b,d,rb}ash rPUx,
-  @{bin}/{c,k,tc,z}sh rPUx,
+  @{bin}/{,b,d,rb}ash rUx,
+  @{bin}/{c,k,tc,z}sh rUx,
 
   /etc/{passwd,group,shadow,gshadow} r,
 

apparmor.d/profiles-m-r/protonmail-bridge

@@ -57,6 +57,7 @@ profile protonmail-bridge @{exec_path}  {
     @{bin}/tty         rix,
     @{bin}/which       rix,
 
+         owner @{user_password_store_dirs}/ r,
          owner @{user_password_store_dirs}/.gpg-id r,
          owner @{user_password_store_dirs}/protonmail-credentials/{,**} rw,
     deny owner @{user_password_store_dirs}/**/ r,

apparmor.d/profiles-m-r/qemu-ga

@@ -21,6 +21,11 @@ profile qemu-ga @{exec_path} {
 
   ptrace peer=unconfined,
 
+  dbus send bus=system path=/org/freedesktop/login1
+       interface=org.freedesktop.login1.Manager
+       member={ScheduleShutdown,SetWallMessage}
+       peer=(name=org.freedesktop.login1, label=systemd-logind),
+
   @{exec_path} mr,
 
   @{bin}/systemctl rix,