feat(profiles): general update.

apparmor.d/profiles-s-z/snap

@@ -26,6 +26,10 @@ profile snap @{exec_path} {
          member={StartTransientUnit,JobRemoved}
          peer=(name=:*, label=unconfined),
 
+  dbus (send, receive) bus=system path=/org/freedesktop/
+         interface=org.freedesktop.systemd1.Manager
+         member={StartTransientUnit,JobRemoved},
+
   dbus send bus=session path=/org/freedesktop/portal/documents
        interface=org.freedesktop.portal.Documents
        member=GetMountPoint
@@ -35,6 +39,7 @@ profile snap @{exec_path} {
 
   /{usr/,}bin/mount rix,
 
+  /{usr/,}bin/gpg{,2}          rCx -> gpg,
   /{usr/,}bin/systemctl        rPx -> child-systemctl,
 
   /snap/{,**} rw,
@@ -77,5 +82,19 @@ profile snap @{exec_path} {
 
   deny @{user_share_dirs}/gvfs-metadata/* r,
 
+  profile gpg {
+    include <abstractions/base>
+
+    /{usr/,}bin/gpg{,2} mr,
+
+    /{usr/,}bin/dirmngr           rix,
+    /{usr/,}bin/gpg-agent         rix,
+    /{usr/,}bin/gpg-connect-agent rix,
+
+    owner @{HOME}/.snap/gnupg/ rw,
+    owner @{HOME}/.snap/gnupg/** rwkl,
+
+  }
+
   include if exists <local/snap>
 }

apparmor.d/profiles-s-z/snapd

@@ -43,6 +43,11 @@ profile snapd @{exec_path} {
   ptrace (read) peer=snap,
   ptrace (read) peer=unconfined,
 
+  dbus (send) bus=system path=/org/freedesktop/
+         interface=org.freedesktop.login1.Manager
+         member={SetWallMessage,ScheduleShutdown}
+         peer=(name=org.freedesktop.login1, label=systemd-logind),
+
   dbus send bus=system path=/org/freedesktop/timedate1
        interface=org.freedesktop.DBus.Properties
        member=Get
@@ -151,6 +156,7 @@ profile snapd @{exec_path} {
   @{sys}/fs/cgroup/system.slice/{,**/} r,
   @{sys}/fs/cgroup/user.slice/ r,
   @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/{,**/} r,
+  @{sys}/kernel/kexec_loaded r,
   @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
   @{sys}/kernel/security/apparmor/features/ r,
   @{sys}/kernel/security/apparmor/profiles r,