feat(profile): restrict some access to @{PROC}/@{pid}.

apparmor.d/groups/bus/dbus-accessibility

@@ -64,12 +64,13 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) {
   @{sys}/kernel/security/apparmor/features/dbus/mask r,
   @{sys}/module/apparmor/parameters/enabled r,
 
-        @{PROC}/@{pid}/attr/apparmor/current r,
-        @{PROC}/@{pid}/cgroup r,
-        @{PROC}/@{pid}/cmdline r,
-        @{PROC}/@{pid}/oom_score_adj r,
+        @{PROC}/1/cgroup r,
+  owner @{PROC}/@{pid}/attr/apparmor/current r,
+  owner @{PROC}/@{pid}/cgroup r,
+  owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mounts r,
+  owner @{PROC}/@{pid}/oom_score_adj r,
 
   owner /dev/tty@{int} rw,
 

apparmor.d/groups/gnome/gnome-session-binary

@@ -91,9 +91,10 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
 
   @{sys}/devices/**/{vendor,device} r,
 
-        @{PROC}/@{pid}/cgroup r,
+        @{PROC}/1/cgroup r,
         @{PROC}/cmdline r,
         @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r,
+  owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/loginuid r,

apparmor.d/groups/gnome/gnome-shell

@@ -347,23 +347,23 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/cpu.max r,
 
         @{PROC}/ r,
-        @{PROC}/@{pid}/attr/current r,
-        @{PROC}/@{pid}/cgroup r,
+        @{PROC}/@{pid}/cmdline r,
         @{PROC}/@{pid}/net/* r,
-        @{PROC}/@{pid}/stat r,
-        @{PROC}/@{pid}/task/@{tid}/stat r,
-        @{PROC}/@{pids}/cmdline r,
         @{PROC}/1/cgroup r,
         @{PROC}/cmdline r,
         @{PROC}/sys/kernel/osrelease r,
         @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r,
         @{PROC}/vmstat r,
+  owner @{PROC}/@{pid}/attr/current r,
+  owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/fdinfo/@{int} r,
   owner @{PROC}/@{pid}/mountinfo r,
   owner @{PROC}/@{pid}/mounts r,
+  owner @{PROC}/@{pid}/stat r,
   owner @{PROC}/@{pid}/task/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,
+  owner @{PROC}/@{pid}/task/@{tid}/stat r,
 
   /dev/input/event@{int} rw,
   /dev/media@{int} rw,

apparmor.d/groups/gnome/gnome-software

@@ -117,10 +117,11 @@ profile gnome-software @{exec_path} {
 
   @{sys}/module/nvidia/version r,
 
-        @{PROC}/@{pid}/cgroup r,
         @{PROC}/@{pids}/mounts r,
+        @{PROC}/1/cgroup r,
         @{PROC}/sys/fs/pipe-max-size r,
         @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
+  owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/fdinfo/@{int} r,
   owner @{PROC}/@{pid}/stat r,

apparmor.d/groups/gnome/gsd-datetime

@@ -43,6 +43,9 @@ profile gsd-datetime @{exec_path} flags=(attach_disconnected) {
 
   @{run}/systemd/sessions/@{int} r,
   @{run}/systemd/users/@{uid} r,
+
+        @{PROC}/1/cgroup r,
+  owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/fdinfo/@{int} r,
   owner @{PROC}/@{pid}/stat r,
 

apparmor.d/groups/gnome/gsd-sharing

@@ -41,7 +41,8 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
   @{run}/systemd/sessions/* r,
   @{run}/systemd/users/@{uid} r,
 
-  @{PROC}/@{pid}/cgroup r,
+        @{PROC}/1/cgroup r,
+  owner @{PROC}/@{pid}/cgroup r,
 
   owner /dev/tty@{int} rw,
 

apparmor.d/groups/gnome/org.gnome.NautilusPreviewer

@@ -43,9 +43,10 @@ profile org.gnome.NautilusPreviewer @{exec_path} {
   @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*org.gnome.NautilusPreviewer.slice/*/memory.* r,
   @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/dbus.service/memory.* r,
 
+        @{PROC}/1/cgroup r,
         @{PROC}/devices r,
-        @{PROC}/@{pid}/cgroup r,
         @{PROC}/zoneinfo r,
+  owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/mounts r,
   owner @{PROC}/@{pid}/stat r,