From 38c6e35a1b0e5af40b06a50484e4b95a86f45581 Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Thu, 29 May 2025 23:33:37 +0200
Subject: [PATCH] feat(profile): add some ubuntu specific profiles.

---
 apparmor.d/groups/ubuntu/apt_news       | 39 +++++++++++++++++++++++++
 apparmor.d/groups/ubuntu/fanctl         | 33 +++++++++++++++++++++
 apparmor.d/groups/ubuntu/ubuntu-fan-net | 24 +++++++++++++++
 dists/flags/ubuntu.flags                |  3 ++
 4 files changed, 99 insertions(+)
 create mode 100644 apparmor.d/groups/ubuntu/apt_news
 create mode 100644 apparmor.d/groups/ubuntu/fanctl
 create mode 100644 apparmor.d/groups/ubuntu/ubuntu-fan-net

diff --git a/apparmor.d/groups/ubuntu/apt_news b/apparmor.d/groups/ubuntu/apt_news
new file mode 100644
index 000000000..faf15dfbe
--- /dev/null
+++ b/apparmor.d/groups/ubuntu/apt_news
@@ -0,0 +1,39 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = /usr/lib/ubuntu-advantage/apt_news.py
+profile apt_news @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+  include <abstractions/common/apt>
+  include <abstractions/nameservice-strict>
+  include <abstractions/python>
+
+  capability chown,
+  capability kill,
+  capability setgid,
+  capability setuid,
+
+  signal send set=int peer=apt-methods-*,
+
+  @{exec_path} mr,
+
+  @{lib}/apt/methods/* Px,
+
+  /etc/ubuntu-advantage/uaclient.conf r,
+
+  @{run}/ubuntu-advantage/ rw,
+  @{run}/ubuntu-advantage/apt-news/{,**} rw,
+
+  owner @{run}/ubuntu-advantage/apt-news/** rw,
+
+  @{PROC}/@{pid}/fd/ r,
+
+  include if exists <local/apt_news>
+}
+
+# vim:syntax=apparmor
diff --git a/apparmor.d/groups/ubuntu/fanctl b/apparmor.d/groups/ubuntu/fanctl
new file mode 100644
index 000000000..ef278da63
--- /dev/null
+++ b/apparmor.d/groups/ubuntu/fanctl
@@ -0,0 +1,33 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{sbin}/fanctl
+profile fanctl @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+
+  network netlink raw,
+
+  @{exec_path} mr,
+
+  @{sh_path}    rix,
+  @{bin}/flock   ix,
+  @{bin}/id      ix,
+  @{bin}/touch   ix,
+  @{bin}/mkdir   ix,
+  @{bin}/ip      ix,
+  @{bin}/sed     ix,
+
+  /etc/network/fan r,
+
+  @{run}/ubuntu-fan/ rw,
+  @{run}/ubuntu-fan/.lock rwk,
+
+  include if exists <local/fanctl>
+}
+
+# vim:syntax=apparmor
diff --git a/apparmor.d/groups/ubuntu/ubuntu-fan-net b/apparmor.d/groups/ubuntu/ubuntu-fan-net
new file mode 100644
index 000000000..f9d7c01f5
--- /dev/null
+++ b/apparmor.d/groups/ubuntu/ubuntu-fan-net
@@ -0,0 +1,24 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/ubuntu-fan/fan-net
+profile ubuntu-fan-net @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  @{sh_path}        mr,
+  @{bin}/{m,g,}awk  ix,
+  @{bin}/grep       ix,
+  @{bin}/networkctl Px,
+  @{sbin}/fanctl    Px,
+
+  include if exists <local/ubuntu-fan-net>
+}
+
+# vim:syntax=apparmor
diff --git a/dists/flags/ubuntu.flags b/dists/flags/ubuntu.flags
index a6d6bcc85..7339702a2 100644
--- a/dists/flags/ubuntu.flags
+++ b/dists/flags/ubuntu.flags
@@ -1,12 +1,14 @@
 apport attach_disconnected,complain
 apport-checkreports complain
 apport-gtk complain
+apt_news attach_disconnected,complain
 apt-esm-hook complain
 apt-esm-json-hook complain
 apt-helper complain
 check-new-release-gtk complain
 do-release-upgrade complain
 dpkg-genbuildinfo complain
+fanctl attach_disconnected,complain
 hwe-support-status complain
 list-oem-metapackages complain
 livepatch-notification complain
@@ -18,6 +20,7 @@ software-properties-gtk complain
 ubuntu-advantage complain
 ubuntu-advantage-notification complain
 ubuntu-distro-info complain
+ubuntu-fan-net attach_disconnected,complain
 ubuntu-report complain
 update-manager attach_disconnected,complain
 update-motd-fsck-at-reboot complain