feat(profile): add some ubuntu specific profiles.

apparmor.d/groups/ubuntu/apt_news

@@ -0,0 +1,39 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = /usr/lib/ubuntu-advantage/apt_news.py
+profile apt_news @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+  include <abstractions/common/apt>
+  include <abstractions/nameservice-strict>
+  include <abstractions/python>
+
+  capability chown,
+  capability kill,
+  capability setgid,
+  capability setuid,
+
+  signal send set=int peer=apt-methods-*,
+
+  @{exec_path} mr,
+
+  @{lib}/apt/methods/* Px,
+
+  /etc/ubuntu-advantage/uaclient.conf r,
+
+  @{run}/ubuntu-advantage/ rw,
+  @{run}/ubuntu-advantage/apt-news/{,**} rw,
+
+  owner @{run}/ubuntu-advantage/apt-news/** rw,
+
+  @{PROC}/@{pid}/fd/ r,
+
+  include if exists <local/apt_news>
+}
+
+# vim:syntax=apparmor

apparmor.d/groups/ubuntu/fanctl

@@ -0,0 +1,33 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{sbin}/fanctl
+profile fanctl @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+
+  network netlink raw,
+
+  @{exec_path} mr,
+
+  @{sh_path}    rix,
+  @{bin}/flock   ix,
+  @{bin}/id      ix,
+  @{bin}/touch   ix,
+  @{bin}/mkdir   ix,
+  @{bin}/ip      ix,
+  @{bin}/sed     ix,
+
+  /etc/network/fan r,
+
+  @{run}/ubuntu-fan/ rw,
+  @{run}/ubuntu-fan/.lock rwk,
+
+  include if exists <local/fanctl>
+}
+
+# vim:syntax=apparmor

apparmor.d/groups/ubuntu/ubuntu-fan-net

@@ -0,0 +1,24 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/ubuntu-fan/fan-net
+profile ubuntu-fan-net @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  @{sh_path}        mr,
+  @{bin}/{m,g,}awk  ix,
+  @{bin}/grep       ix,
+  @{bin}/networkctl Px,
+  @{sbin}/fanctl    Px,
+
+  include if exists <local/ubuntu-fan-net>
+}
+
+# vim:syntax=apparmor