feat(profile): small update on core upgrade profiles.

apparmor.d/groups/apt/apt

@@ -36,7 +36,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
   unix bind type=stream addr=@@{udbus}/bus/apt-get/system,
   unix bind type=stream addr=@@{udbus}/bus/apt/system,
 
-  unix                 type=stream peer=(label=snap),
+  unix                 type=stream peer=(label=@{p_snap}),
   unix (send, receive) type=stream peer=(label=apt-esm-json-hook),
   unix (send, receive) type=stream peer=(label=snapd),
 

apparmor.d/groups/apt/apt-methods-cdrom

@@ -19,10 +19,10 @@ profile apt-methods-cdrom @{exec_path} {
   capability setgid,
   capability setuid,
 
-  signal (receive) peer=apt,
+  signal receive peer=apt,
-  signal (receive) peer=apt-get,
+  signal receive peer=apt-get,
-  signal (receive) peer=aptitude,
+  signal receive peer=aptitude,
-  signal (receive) peer=synaptic,
+  signal receive peer=synaptic,
 
   @{exec_path} mr,
 

apparmor.d/groups/apt/apt-methods-copy

@@ -20,10 +20,10 @@ profile apt-methods-copy @{exec_path} {
   capability setgid,
   capability setuid,
 
-  signal (receive) peer=apt,
+  signal receive peer=apt,
-  signal (receive) peer=apt-get,
+  signal receive peer=apt-get,
-  signal (receive) peer=aptitude,
+  signal receive peer=aptitude,
-  signal (receive) peer=synaptic,
+  signal receive peer=synaptic,
 
   @{exec_path} mr,
 

apparmor.d/groups/apt/apt-methods-file

@@ -20,11 +20,11 @@ profile apt-methods-file @{exec_path} {
   capability setgid,
   capability setuid,
 
-  signal (receive) peer=apt-get,
+  signal receive peer=apt-get,
-  signal (receive) peer=apt,
+  signal receive peer=apt,
-  signal (receive) peer=aptitude,
+  signal receive peer=aptitude,
-  signal (receive) peer=packagekitd,
+  signal receive peer=@{p_packagekitd},
-  signal (receive) peer=synaptic,
+  signal receive peer=synaptic,
 
   @{exec_path} mr,
 

apparmor.d/groups/apt/apt-methods-ftp

@@ -19,10 +19,10 @@ profile apt-methods-ftp @{exec_path} {
   capability setgid,
   capability setuid,
 
-  signal (receive) peer=apt,
+  signal receive peer=apt,
-  signal (receive) peer=apt-get,
+  signal receive peer=apt-get,
-  signal (receive) peer=aptitude,
+  signal receive peer=aptitude,
-  signal (receive) peer=synaptic,
+  signal receive peer=synaptic,
 
   @{exec_path} mr,
 

apparmor.d/groups/apt/apt-methods-gpgv

@@ -20,12 +20,12 @@ profile apt-methods-gpgv @{exec_path} {
   capability setgid,
   capability setuid,
 
-  signal (receive) peer=apt-get,
+  signal receive peer=apt-get,
-  signal (receive) peer=apt,
+  signal receive peer=apt,
-  signal (receive) peer=aptitude,
+  signal receive peer=aptitude,
-  signal (receive) peer=packagekitd,
+  signal receive peer=@{p_packagekitd},
-  signal (receive) peer=role_*,
+  signal receive peer=role_*,
-  signal (receive) peer=synaptic,
+  signal receive peer=synaptic,
 
   @{exec_path} mr,
 

apparmor.d/groups/apt/apt-methods-http

@@ -23,15 +23,15 @@ profile apt-methods-http @{exec_path} {
   network inet6 stream,
   network netlink raw,
 
-  signal (receive) peer=apt-get,
+  signal receive peer=apt-get,
-  signal (receive) peer=apt,
+  signal receive peer=apt,
-  signal (receive) peer=aptitude,
+  signal receive peer=aptitude,
-  signal (receive) peer=packagekitd,
+  signal receive peer=@{p_packagekitd},
-  signal (receive) peer=role_*,
+  signal receive peer=role_*,
-  signal (receive) peer=synaptic,
+  signal receive peer=synaptic,
-  signal (receive) peer=ubuntu-advantage,
+  signal receive peer=ubuntu-advantage,
-  signal (receive) peer=unattended-upgrade,
+  signal receive peer=unattended-upgrade,
-  signal (receive) peer=update-manager,
+  signal receive peer=update-manager,
 
   ptrace (read),
 

apparmor.d/groups/apt/apt-methods-mirror

@@ -20,11 +20,11 @@ profile apt-methods-mirror @{exec_path} {
   capability setgid,
   capability setuid,
 
-  signal (receive) peer=apt-get,
+  signal receive peer=apt-get,
-  signal (receive) peer=apt,
+  signal receive peer=apt,
-  signal (receive) peer=aptitude,
+  signal receive peer=aptitude,
-  signal (receive) peer=packagekitd,
+  signal receive peer=@{p_packagekitd},
-  signal (receive) peer=synaptic,
+  signal receive peer=synaptic,
 
   @{exec_path} mr,
 

apparmor.d/groups/apt/apt-methods-rred

@@ -20,11 +20,11 @@ profile apt-methods-rred @{exec_path} {
   capability setgid,
   capability setuid,
 
-  signal (receive) peer=apt,
+  signal receive peer=apt,
-  signal (receive) peer=apt-get,
+  signal receive peer=apt-get,
-  signal (receive) peer=aptitude,
+  signal receive peer=aptitude,
-  signal (receive) peer=synaptic,
+  signal receive peer=synaptic,
-  signal (receive) set=(int) peer=packagekitd,
+  signal receive set=(int) peer=@{p_packagekitd},
 
   @{exec_path} mr,
 

apparmor.d/groups/apt/apt-methods-rsh

@@ -19,10 +19,10 @@ profile apt-methods-rsh @{exec_path} {
   capability setgid,
   capability setuid,
 
-  signal (receive) peer=apt,
+  signal receive peer=apt,
-  signal (receive) peer=apt-get,
+  signal receive peer=apt-get,
-  signal (receive) peer=aptitude,
+  signal receive peer=aptitude,
-  signal (receive) peer=synaptic,
+  signal receive peer=synaptic,
 
   @{exec_path} mr,
 

apparmor.d/groups/apt/apt-methods-store

@@ -20,12 +20,12 @@ profile apt-methods-store @{exec_path} {
   capability setgid,
   capability setuid,
 
-  signal (receive) peer=apt-get,
+  signal receive peer=apt-get,
-  signal (receive) peer=apt,
+  signal receive peer=apt,
-  signal (receive) peer=aptitude,
+  signal receive peer=aptitude,
-  signal (receive) peer=packagekitd,
+  signal receive peer=@{p_packagekitd},
-  signal (receive) peer=role_*,
+  signal receive peer=role_*,
-  signal (receive) peer=synaptic,
+  signal receive peer=synaptic,
 
   @{exec_path} mr,
 

apparmor.d/groups/apt/deb-systemd-helper

@@ -16,8 +16,8 @@ profile deb-systemd-helper @{exec_path} {
 
   @{bin}/systemctl rCx -> systemctl,
 
-  /etc/systemd/system/* w,
+  /etc/systemd/system/{,**} rw,
-  /etc/systemd/user/* w,
+  /etc/systemd/user/{,**} rw,
 
   /var/lib/systemd/deb-systemd-helper-enabled/{,**} rw,
   /var/lib/systemd/deb-systemd-helper-masked/{,**} rw,

apparmor.d/groups/grub/grub-install

@@ -44,7 +44,7 @@ profile grub-install @{exec_path} flags=(complain) {
   @{sys}/firmware/efi/efivars/ r,
   @{sys}/firmware/efi/efivars/Boot@{hex}-@{uuid} rw,
   @{sys}/firmware/efi/efivars/BootCurrent-@{uuid} r,
-  @{sys}/firmware/efi/efivars/BootOrder-@{uuid} r,
+  @{sys}/firmware/efi/efivars/BootOrder-@{uuid} rw,
   @{sys}/firmware/efi/efivars/Timeout-@{uuid} r,
   @{sys}/firmware/efi/fw_platform_size r,
   @{sys}/firmware/efi/w_platform_size r,

apparmor.d/groups/grub/grub-mkdevicemap

@@ -10,9 +10,16 @@ include <tunables/global>
 profile grub-mkdevicemap @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
+  include <abstractions/disks-read>
+
+  capability sys_admin,
 
   @{exec_path} mr,
 
+  @{PROC}/devices r,
+
+  /dev/mapper/control rw,
+
   include if exists <local/grub-mkdevicemap>
 }
 

apparmor.d/profiles-a-f/e2scrub_all

@@ -17,8 +17,8 @@ profile e2scrub_all @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
-  @{sh_path}         r,
+  @{sh_path}        mr,
-  @{bin}/readlink  rix,
+  @{bin}/readlink   ix,
 
   /etc/e2scrub.conf r,
 

apparmor.d/profiles-a-f/finalrd

@@ -20,27 +20,27 @@ profile finalrd @{exec_path} {
   @{exec_path} mr,
 
   @{sh_path}               rix,
-  @{bin}/cp                rix,
+  @{bin}/cp                 ix,
-  @{bin}/dirname           rix,
+  @{bin}/dirname            ix,
-  @{bin}/env               rix,
+  @{bin}/env                ix,
-  @{bin}/find              rix,
+  @{bin}/find               ix,
-  @{bin}/grep              rix,
+  @{bin}/grep               ix,
-  @{sbin}/ldconfig{,.real} rix,
+  @{bin}/ln                 ix,
-  @{bin}/ln                rix,
+  @{bin}/mkdir              ix,
-  @{bin}/mkdir             rix,
+  @{bin}/mount              ix,
-  @{bin}/mount             rix,
+  @{bin}/readlink           ix,
-  @{bin}/readlink          rix,
+  @{bin}/realpath           ix,
-  @{bin}/realpath          rix,
+  @{bin}/rm                 ix,
-  @{bin}/rm                rix,
+  @{bin}/run-parts          ix,
-  @{bin}/run-parts         rix,
+  @{bin}/sed                ix,
-  @{bin}/sed               rix,
+  @{bin}/touch              ix,
-  @{bin}/touch             rix,
+  @{sbin}/ldconfig{,.real}  ix,
 
-  @{bin}/ldd                         rCx -> ldd,
+  @{bin}/ldd                         Cx -> ldd,
-  @{bin}/systemd-tmpfiles            rPx,
+  @{bin}/systemd-tmpfiles            Px,
-  @{lib}/@{multiarch}/ld-linux-*so*  rCx -> ldd,
+  @{lib}/@{multiarch}/ld-linux-*so*  Cx -> ldd,
-  @{lib}/systemd/systemd-shutdown    rPx,
+  @{lib}/systemd/systemd-shutdown    Px,
-  /usr/share/finalrd/*.finalrd       rix,
+  /usr/share/finalrd/*.finalrd       ix,
 
   @{bin}/{,*} r,
   @{lib}/{,*} r,
@@ -65,6 +65,7 @@ profile finalrd @{exec_path} {
 
   profile ldd {
     include <abstractions/base>
+    include <abstractions/consoles>
     include <abstractions/nameservice-strict>
 
     @{bin}/* mr,

apparmor.d/profiles-g-l/glib-compile-schemas

@@ -6,7 +6,7 @@ abi <abi/4.0>,
 
 include <tunables/global>
 
-@{exec_path} = @{bin}/glib-compile-schemas
+@{exec_path} = @{bin}/glib-compile-schemas @{lib}/@{multiarch}/glib-2.0/glib-compile-schemas
 profile glib-compile-schemas @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>

apparmor.d/profiles-g-l/landscape-sysinfo

@@ -33,6 +33,7 @@ profile landscape-sysinfo @{exec_path} {
 
   /var/log/landscape/{,**} rw,
 
+  @{run}/systemd/sessions/{,*} r,
   @{run}/utmp rwk,
 
   @{sys}/class/hwmon/ r,

apparmor.d/profiles-g-l/logrotate

@@ -21,8 +21,8 @@ profile logrotate @{exec_path} flags=(attach_disconnected) {
   capability setgid,
   capability setuid,
 
-  signal (send) set=(hup),
+  signal send set=hup,
-  signal (send) set=(term cont) peer=systemd-tty-ask-password-agent,
+  signal send set=(term cont) peer=systemd-tty-ask-password-agent,
 
   @{exec_path} mr,
 

apparmor.d/profiles-m-r/multipathd

@@ -20,7 +20,8 @@ profile multipathd @{exec_path} {
 
   network netlink raw,
 
-  unix (send, receive, connect) type=stream peer=(addr="@/org/kernel/linux/storage/multipathd"),
+  unix type=stream peer=(addr="@/org/kernel/linux/storage/multipathd"),
+  unix type=stream addr=@/org/kernel/linux/storage/multipathd,
 
   @{exec_path} mr,
 

apparmor.d/profiles-m-r/pycompile

@@ -31,6 +31,7 @@ profile pycompile @{exec_path} flags=(attach_disconnected,complain) {
   /usr/share/python3/{,**} r,
 
   / r,
+  @{bin}/ r,
 
   profile dpkg {
     include <abstractions/base>

apparmor.d/profiles-m-r/qemu-ga

@@ -12,7 +12,7 @@ profile qemu-ga @{exec_path} {
 
   @{exec_path} mr,
 
-  audit @{bin}/systemctl Cx -> systemctl,
+  @{bin}/systemctl Cx -> systemctl,
 
   /etc/qemu/qemu-ga.conf r,