General profiles update.

apparmor.d/groups/apt/apt-methods-http

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2019-2022 Mikhail Morfikov
+# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -61,6 +62,8 @@ profile apt-methods-http @{exec_path} {
 
   owner /tmp/apt-changelog-*/*.changelog rw,
 
+  @{run}/resolvconf/resolv.conf r,
+
   @{PROC}/1/cgroup r,
   @{PROC}/@{pid}/cgroup r,
 

apparmor.d/groups/apt/unattended-upgrade

@@ -9,20 +9,52 @@ include <tunables/global>
 @{exec_path} = /{usr/,}bin/unattended-upgrade
 profile unattended-upgrade @{exec_path} {
   include <abstractions/base>
+  include <abstractions/nameservice-strict>
   include <abstractions/python>
 
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability kill,
+  capability setgid,
+  capability setuid,
+  capability sys_nice,
+
   @{exec_path} mr,
 
-  /{usr/,}bin/python3.[0-9]*  rix,
-  /{usr/,}bin/uname           rix,
+  /{usr/,}bin/ r,
+
   /{usr/,}bin/dpkg            rPx,
   /{usr/,}bin/lsb_release     rPx -> lsb_release,
+  /{usr/,}bin/python3.[0-9]*  rix,
+  /{usr/,}bin/uname           rix,
+  /{usr/,}lib/apt/methods/http{,s} rPx,
+
+  /usr/share/dpkg/*table r,
+
+  /etc/apt/*.list r,
+  /etc/apt/apt.conf.d/{,**} r,
+  /etc/apt/preferences.d/{,**} r,
+  /etc/apt/sources.list.d/{,**} r,
+
+  /etc/machine-id r,
 
   /var/log/unattended-upgrades/*.log rw,
 
+  /var/lib/apt/extended_states r,
+  /var/lib/apt/lists/{,**} r,
+  /var/lib/dpkg/lock rwk,
+  /var/lib/dpkg/lock-frontend rwk,
+  /var/lib/dpkg/status r,
+
+  /var/cache/apt/archives/{,**} rw,
+  /var/cache/apt/pkgcache.bin r,
+
   owner @{run}/unattended-upgrades.pid rw,
   owner @{run}/unattended-upgrades.lock rwk,
 
+  owner /tmp/#[0-9]* rw,
+
   owner @{PROC}/@{pids}/fd/ r,
 
   include if exists <local/unattended-upgrade>