feat(profiles): general update.

apparmor.d/profiles-m-r/packagekitd

@@ -20,9 +20,11 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
   capability dac_read_search,
   capability fowner,
   capability kill,
+  capability mknod,
   capability net_admin,
   capability setgid,
   capability setuid,
+  capability sys_chroot,
   capability sys_nice,
 
   network inet stream,
@@ -96,6 +98,7 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
   /{usr/,}bin/touch          rix,
 
   /{usr/,}bin/appstreamcli                rPx,
+  /{usr/,}bin/arch-audit                  rPx,
   /{usr/,}bin/dpkg                        rPx -> child-dpkg,
   /{usr/,}bin/glib-compile-schemas        rPx,
   /{usr/,}bin/systemd-inhibit             rPx,
@@ -128,9 +131,12 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
         @{PROC}/@{pids}/cgroup r,
         @{PROC}/@{pids}/mountinfo r,
         @{PROC}/sys/kernel/random/uuid r,
+  owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mounts r,
 
+  /dev/tty rw,
+
   profile gpg {
     include <abstractions/base>
     include <abstractions/nameservice-strict>

apparmor.d/profiles-m-r/pass

@@ -43,6 +43,7 @@ profile pass @{exec_path} {
 
   /{usr/,}bin/git             rCx -> git,
   /{usr/,}bin/gpg{2,}         rUx,
+  /{usr/,}bin/qdbus           rCx -> qdbus,
   /{usr/,}bin/vim{,.*}        rCx -> editor,
   /{usr/,}bin/wl-{copy,paste} rPx,
   /{usr/,}bin/xclip           rPx,
@@ -134,6 +135,14 @@ profile pass @{exec_path} {
     include if exists <local/pass_git>
   }
 
+    profile qdbus {
+    include <abstractions/base>
+
+    /{usr/,}bin/qdbus mr,
+
+    include if exists <local/pass_qdbus>
+  }
+
   include if exists <usr/pass.d>
   include if exists <local/pass>
 }

apparmor.d/profiles-m-r/pidof

@@ -16,6 +16,8 @@ profile pidof @{exec_path} {
 
   @{exec_path} mr,
 
+  /app/lib/libzypak-preload-host*.so rm,
+
   @{PROC}/ r,
   @{PROC}/@{pids}/cmdline r,
   @{PROC}/@{pids}/stat r,

apparmor.d/profiles-m-r/pwck

@@ -24,5 +24,7 @@ profile pwck @{exec_path} {
   /etc/shadow.[0-9]* rw,
   /etc/shadow.lock wl,
 
+  /etc/machine-id r,
+
   include if exists <local/pwck>
 }