General update

Signed-off-by: Jeroen Rijken <jeroen.rijken@xs4all.nl>

apparmor.d/groups/apt/apt

@@ -70,6 +70,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
   /{usr/,}bin/gdbus      rix,
   /{usr/,}bin/id         rix,
   /{usr/,}bin/ischroot   rix,
+  /{usr/,}bin/systemctl  rix,
   /{usr/,}bin/test       rix,
   /{usr/,}bin/touch      rix,
 

apparmor.d/groups/apt/apt-methods-gpgv

@@ -84,6 +84,15 @@ profile apt-methods-gpgv @{exec_path} {
   owner /tmp/apt-key-gpghome.*/** rwkl -> /tmp/apt-key-gpghome.*/**,
   owner /tmp/apt.{conf,sig,data}.* rw,
 
+        /var/lib/apt/lists/{,**} r,
+  owner {/var/lib/ubuntu-advantage/apt-esm,}/var/lib/apt/lists/* rw,
+  owner /var/lib/apt/lists/partial/* rw,
+
+  /usr/share/dpkg/cputable r,
+  /usr/share/dpkg/tupletable r,
+
+  /var/lib/dpkg/arch r,
+
   @{PROC}/@{pid}/fd/ r,
 
   # file_inherit

apparmor.d/groups/apt/apt-methods-http

@@ -54,8 +54,9 @@ profile apt-methods-http @{exec_path} {
   /var/log/cron-apt/temp w,
 
         /var/lib/apt/lists/{,**} r,
-  owner /var/lib/apt/lists/* rw,
+  owner {/var/lib/ubuntu-advantage/apt-esm,}/var/lib/apt/lists/* rw,
   owner /var/lib/apt/lists/partial/* rw,
+  owner /var/lib/apt/lists/{,**} rw,
 
   # For package building
   @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,

apparmor.d/groups/freedesktop/pulseaudio

@@ -42,7 +42,7 @@ profile pulseaudio @{exec_path} {
 
   dbus receive bus=system path=/Client0/EntryGroup[0-9]*
        interface=org.freedesktop.Avahi.EntryGroup
-       member=StateChanged
+       member={AddService,AddServiceSubtype,Commit,GetState,StateChanged}
        peer=(name=org.freedesktop.Avahi),
 
   dbus send bus=session path=/org/freedesktop/DBus
@@ -108,6 +108,11 @@ profile pulseaudio @{exec_path} {
        member=Get
        peer=(name=/org/freedesktop/hostname[0-9]),
 
+  dbus send bus=system path=/org/freedesktop/hostname[0-9]
+       interface=org.freedesktop.DBus.Properties
+       member=Get
+       peer=(name=org.freedesktop.hostname[0-9])
+
   @{exec_path} mrix,
 
   @{libexec}/pulse/gsettings-helper mrix,

apparmor.d/groups/virt/containerd

@@ -88,7 +88,7 @@ profile containerd @{exec_path} flags=(attach_disconnected) {
   owner /var/tmp/** rwkl,
   owner /tmp/** rwkl,
         /tmp/cri-containerd.apparmor.d[0-9]* rwl,
-        /tmp/ctd-volume[0-9]*/{data/,} rw,
+        /tmp/ctd-volume[0-9]*/{,**} rw,
 
   @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
   @{sys}/kernel/security/apparmor/profiles r,
@@ -96,6 +96,7 @@ profile containerd @{exec_path} flags=(attach_disconnected) {
 
         @{PROC}/@{pid}/task/@{tid}/ns/net rw,
   owner @{PROC}/@{pids}/attr/current r,
+  owner @{PROC}/@{pids}/cgroup r,
   owner @{PROC}/@{pids}/uid_map r,
   owner @{PROC}/@{pids}/mountinfo r,
         @{PROC}/sys/net/core/somaxconn r,

apparmor.d/groups/virt/k3s

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}{local/,}bin/k3s
-profile k3s @{exec_path} {
+profile k3s @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/disks-read>
   include <abstractions/nameservice-strict>

apparmor.d/profiles-m-r/run-parts

@@ -145,6 +145,7 @@ profile run-parts @{exec_path} {
 
     /var/cache/motd-news r,
     /var/lib/update-notifier/updates-available r,
+    /var/lib/ubuntu-advantage/messages/motd-esm-announce r,
 
     @{run}/motd.d/{,*} r,