add ssh-sk-helper

apparmor.d/groups/ssh/ssh

@@ -25,6 +25,8 @@ profile ssh @{exec_path} {
 
   @{bin}/@{shells}     rUx,
 
+  @{lib}/ssh/ssh-sk-helper rix -> ssh//null-@{lib}/ssh/ssh-sk-helper,
+
   @{etc_ro}/ssh/ssh_config r,
   @{etc_ro}/ssh/ssh_config.d/{,*} r,
   @{etc_ro}/ssh/sshd_config r,

apparmor.d/groups/ssh/ssh-sk-helper

@@ -0,0 +1,26 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2024 valoq <valoq@mailbox.org>
+# SPDX-License-Identifier: GPL-2.0-only
+
+profile ssh//null-@{lib}/ssh/ssh-sk-helper {
+  / r,
+
+  @{lib}/ssh/ssh-sk-helper r,
+
+  /etc/ssl/openssl.cnf r,
+
+  @{sys}/ r,
+  @{sys}/bus/ r,
+  @{sys}/class/ r,
+  @{sys}/class/hidraw/ r,
+  @{sys}/class/hidraw/hidraw@{int} r,
+  @{sys}/devices/ r,
+  @{sys}/devices/@{pci_bus}/ r,
+  @{sys}/devices/@{pci_bus}/{,**} r,
+
+  /dev/hidraw@{int} rwk,
+
+  include if exists <local/ssh-sk-helper>
+}
+
+# vim:syntax=apparmor