update apparmor profiles

apparmor.d/groups/apps/discord

@@ -81,6 +81,7 @@ profile discord @{exec_path} {
        owner @{PROC}/@{pid}/fd/ r,
   deny       @{PROC}/vmstat r,
   deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
+       owner @{PROC}/@{pids}/clear_refs w,
        owner @{PROC}/@{pids}/task/ r,
              @{PROC}/@{pids}/task/@{tid}/status r,
   deny       @{PROC}/@{pids}/stat r,

apparmor.d/groups/apt/dpkg-architecture

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}bin/dpkg-architecture
 profile dpkg-architecture @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
   include <abstractions/perl>
 
   @{exec_path} r,

apparmor.d/groups/cron/cron

@@ -84,6 +84,7 @@ profile cron @{exec_path} {
     /etc/cron.{hourly,daily,weekly,monthly}/logrotate            rPx,
     /etc/cron.{hourly,daily,weekly,monthly}/mlocate              rPx,
     /etc/cron.{hourly,daily,weekly,monthly}/dlocate              rPx,
+    /etc/cron.{hourly,daily,weekly,monthly}/plocate              rPx,
     /etc/cron.{hourly,daily,weekly,monthly}/passwd              rPUx,
     /etc/cron.{hourly,daily,weekly,monthly}/apt-compat           rPx,
     /etc/cron.{hourly,daily,weekly,monthly}/aptitude             rPx,

apparmor.d/groups/cron/cron-plocate

@@ -0,0 +1,30 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/plocate
+profile cron-plocate @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+
+  @{exec_path} r,
+  /{usr/,}bin/{,ba,da}sh rix,
+
+  /{usr/,}bin/which      rix,
+  /{usr/,}bin/true       rix,
+  /{usr/,}bin/flock      rix,
+  /{usr/,}bin/nocache    rix,
+  /{usr/,}bin/ionice     rix,
+  /{usr/,}bin/nice       rix,
+
+  /{usr/,}sbin/updatedb.plocate rPx,
+  /{usr/,}sbin/on_ac_power      rPx,
+
+  @{run}/plocate.daily.lock rwk,
+
+  include if exists <local/cron-plocate>
+}