feat(profile): add some ubuntu specific profiles.

apparmor.d/groups/ubuntu/apt_news

@@ -0,0 +1,39 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = /usr/lib/ubuntu-advantage/apt_news.py
+profile apt_news @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+  include <abstractions/common/apt>
+  include <abstractions/nameservice-strict>
+  include <abstractions/python>
+
+  capability chown,
+  capability kill,
+  capability setgid,
+  capability setuid,
+
+  signal send set=int peer=apt-methods-*,
+
+  @{exec_path} mr,
+
+  @{lib}/apt/methods/* Px,
+
+  /etc/ubuntu-advantage/uaclient.conf r,
+
+  @{run}/ubuntu-advantage/ rw,
+  @{run}/ubuntu-advantage/apt-news/{,**} rw,
+
+  owner @{run}/ubuntu-advantage/apt-news/** rw,
+
+  @{PROC}/@{pid}/fd/ r,
+
+  include if exists <local/apt_news>
+}
+
+# vim:syntax=apparmor

apparmor.d/groups/ubuntu/fanctl

@@ -0,0 +1,33 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{sbin}/fanctl
+profile fanctl @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+
+  network netlink raw,
+
+  @{exec_path} mr,
+
+  @{sh_path}    rix,
+  @{bin}/flock   ix,
+  @{bin}/id      ix,
+  @{bin}/touch   ix,
+  @{bin}/mkdir   ix,
+  @{bin}/ip      ix,
+  @{bin}/sed     ix,
+
+  /etc/network/fan r,
+
+  @{run}/ubuntu-fan/ rw,
+  @{run}/ubuntu-fan/.lock rwk,
+
+  include if exists <local/fanctl>
+}
+
+# vim:syntax=apparmor

apparmor.d/groups/ubuntu/ubuntu-fan-net

@@ -0,0 +1,24 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/ubuntu-fan/fan-net
+profile ubuntu-fan-net @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  @{sh_path}        mr,
+  @{bin}/{m,g,}awk  ix,
+  @{bin}/grep       ix,
+  @{bin}/networkctl Px,
+  @{sbin}/fanctl    Px,
+
+  include if exists <local/ubuntu-fan-net>
+}
+
+# vim:syntax=apparmor

dists/flags/ubuntu.flags

@@ -1,12 +1,14 @@
 apport attach_disconnected,complain
 apport-checkreports complain
 apport-gtk complain
+apt_news attach_disconnected,complain
 apt-esm-hook complain
 apt-esm-json-hook complain
 apt-helper complain
 check-new-release-gtk complain
 do-release-upgrade complain
 dpkg-genbuildinfo complain
+fanctl attach_disconnected,complain
 hwe-support-status complain
 list-oem-metapackages complain
 livepatch-notification complain
@@ -18,6 +20,7 @@ software-properties-gtk complain
 ubuntu-advantage complain
 ubuntu-advantage-notification complain
 ubuntu-distro-info complain
+ubuntu-fan-net attach_disconnected,complain
 ubuntu-report complain
 update-manager attach_disconnected,complain
 update-motd-fsck-at-reboot complain