fix(profile): fixes for issues raised by newly enabled tests.

apparmor.d/groups/apt/dpkg-preconfigure

@@ -36,6 +36,7 @@ profile dpkg-preconfigure @{exec_path} {
   @{bin}/stty                  ix,
   @{bin}/tr                    ix,
   @{bin}/uniq                  ix,
+  @{bin}/which{,.debianutils}  ix,
 
   @{bin}/apt-extracttemplates      Px,
   @{bin}/dpkg                      Px -> child-dpkg,

apparmor.d/groups/apt/dpkg-script-linux

@@ -19,11 +19,14 @@ profile dpkg-script-linux @{exec_path} {
   @{bin}/run-parts   ix,
   @{bin}/stty        ix,
 
+  @{bin}/deb-systemd-helper       Px,
+  @{bin}/deb-systemd-invoke       Px,
+  @{bin}/dpkg-maintscript-helper  Px,
   @{bin}/dpkg-trigger             Px,
   @{bin}/kmod                     Px,
   @{bin}/linux-check-removal      Px,
   @{bin}/linux-update-symlinks    Px,
-  @{bin}/dpkg-maintscript-helper  Px,
+  @{bin}/systemctl                Cx -> systemctl,
 
   /usr/share/{update,reboot}-notifier/notify-reboot-required  Px,
   /etc/kernel/{,header_}postinst.d/*                          Px,
@@ -36,6 +39,13 @@ profile dpkg-script-linux @{exec_path} {
   @{lib}/linux/triggers/* w,
   @{lib}/modules/*/.fresh-install w,
 
+  profile systemctl {
+    include <abstractions/base>
+    include <abstractions/app/systemctl>
+
+    include if exists <local/dpkg-script-linux_systemctl>
+  }
+
   include if exists <local/dpkg-script-linux>
 }
 

apparmor.d/groups/apt/dpkg-scripts

@@ -80,6 +80,7 @@ profile dpkg-scripts @{exec_path} {
   /tmp/tmp.@{rand10} rw,
 
   @{PROC}/@{pid}/fd/ r,
+  @{PROC}/@{pid}/mountinfo r,
 
   profile bus {
     include <abstractions/base>

apparmor.d/groups/network/netplan-generate

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{lib}/netplan/generate
 profile netplan-generate @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/consoles>
   include <abstractions/nameservice-strict>
 
   capability chown,

apparmor.d/profiles-s-z/ucf

@@ -10,6 +10,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/ucf
 profile ucf @{exec_path} {
   include <abstractions/base>
+  include <abstractions/common/debconf>
   include <abstractions/consoles>
   include <abstractions/perl>
 
@@ -17,11 +18,11 @@ profile ucf @{exec_path} {
   @{sh_path}            rix,
 
   @{bin}/{,e}grep       rix,
+  @{bin}/{m,g,}awk      rix,
   @{bin}/basename       rix,
   @{bin}/cat            rix,
   @{bin}/cp             rix,
   @{bin}/dirname        rix,
-  @{bin}/{m,g,}awk      rix,
   @{bin}/getopt         rix,
   @{bin}/id             rix,
   @{bin}/md5sum         rix,
@@ -39,8 +40,6 @@ profile ucf @{exec_path} {
   @{bin}/dpkg-divert    rPx,
   @{pager_path}         rCx -> child-pager,
 
-  /usr/share/debconf/frontend  Cx -> debconf,
-
   # For md5sum
   /usr/share/** r,
 
@@ -57,13 +56,6 @@ profile ucf @{exec_path} {
 
   deny capability sys_admin, # optional: no audit
 
-  profile debconf {
-    include <abstractions/base>
-    include <abstractions/common/debconf>
-
-    include if exists <local/ucf_debconf>
-  }
-
   include if exists <local/ucf>
 }