feat(profile): small profiles update.

apparmor.d/groups/cron/cron-debsums

@@ -14,15 +14,13 @@ profile cron-debsums @{exec_path} {
   @{exec_path} mr,
 
   @{sh_path}        rix,
-  @{bin}/true       rix,
+  @{bin}/{,e}grep   rix,
+  @{bin}/debsums    rPx,
+  @{bin}/ionice     rix,
   @{bin}/logger     rix,
   @{bin}/sed        rix,
-  @{bin}/{,e}grep   rix,
-
-  @{bin}/ionice     rix,
-
-  @{bin}/debsums    rPx,
   @{bin}/tee        rCx -> tee,
+  @{bin}/true       rix,
 
   /etc/ r,
   /etc/default/debsums r,
@@ -31,17 +29,15 @@ profile cron-debsums @{exec_path} {
   # For shell pwd
   / r,
 
-
   profile tee {
     include <abstractions/base>
     include <abstractions/consoles>
 
-    # Needed to write to /proc/self/fd/3
     capability dac_override,
 
     @{bin}/tee mr,
 
-    owner @{PROC}/@{pid}/fd/3 rw,
+    owner @{PROC}/@{pid}/fd/@{int} rw,
 
     include if exists <local/cron-debsums_tee>
   }

apparmor.d/groups/gnome/gio-launch-desktop

@@ -43,7 +43,6 @@ profile gio-launch-desktop @{exec_path} flags=(attach_disconnected) {
 
   /dev/dri/card@{int} rw,
 
-  deny @{user_share_dirs}/gvfs-metadata/{,*} r,
 
   include if exists <local/gio-launch-desktop>
 }

apparmor.d/groups/gnome/gnome-characters

@@ -24,6 +24,7 @@ profile gnome-characters @{exec_path} {
   @{open_path} rPx -> child-open-help,
 
   /usr/share/org.gnome.Characters/{,**} r,
+  /usr/share/xml/iso-codes/{,**} r,
 
   owner @{PROC}/@{pid}/mounts r,
   owner @{PROC}/@{pid}/stat r,

apparmor.d/groups/gnome/gnome-extension-manager

@@ -32,6 +32,7 @@ profile gnome-extension-manager @{exec_path} {
 
         @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
   owner @{PROC}/@{pid}/cmdline r,
+  owner @{PROC}/@{pid}/task/@{tid}/comm rw,
 
   # Silencer
   deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,

apparmor.d/groups/gnome/gnome-software

@@ -125,6 +125,7 @@ profile gnome-software @{exec_path} {
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/fdinfo/@{int} r,
   owner @{PROC}/@{pid}/stat r,
+  owner @{PROC}/@{pid}/task/@{tid}/comm rw,
 
   /dev/fuse rw,
  

apparmor.d/groups/systemd/systemd-dissect

@@ -17,10 +17,11 @@ profile systemd-dissect @{exec_path} flags=(attach_disconnected) {
   capability sys_admin,
   capability sys_resource,
 
-  mount options=(rw rshared rslave)                 -> /,
-  mount options=(rw nodev)                          -> /mnt/*/,
   mount                                             -> /tmp/dissect-@{rand6}/,
-  mount options=(ro nodev)          /dev/loop* -> @{run}/systemd/dissect-root/,
+  mount fstype=tmpfs options=(rw nodev)      rootfs -> @{run}/systemd/dissect-root/,
+  mount options=(ro nodev)               /dev/loop* -> @{run}/systemd/dissect-root/{,**/},
+  mount options=(rw nodev)                          -> /mnt/*/,
+  mount options=(rw rshared rslave)                 -> /,
 
   umount @{run}/systemd/dissect-root/,
 

apparmor.d/groups/virt/dockerd

@@ -83,10 +83,20 @@ profile dockerd @{exec_path} flags=(attach_disconnected) {
   # TODO: should be in a sub profile started with pivot_root, not supported yet.
   /{,**} rwl,
 
+  /etc/docker/{,**} r,
+
+  / r,
+
+  owner @{lib}/containerd/** w,
   owner @{lib}/docker/overlay2/*/work/{,**} rw,
+  owner /var/lib/containerd/** w,
   owner /var/lib/docker/{,**} rwk,
   owner /var/lib/docker/tmp/qemu-check@{int}/check rix,
 
+  owner @{run}/docker/ rw,
+  owner @{run}/docker/** rwlk,
+  owner @{run}/docker.pid rw,
+
   @{sys}/fs/cgroup/cgroup.controllers r,
   @{sys}/fs/cgroup/cpuset.cpus.effective r,
   @{sys}/fs/cgroup/cpuset.mems.effective r,
@@ -101,16 +111,20 @@ profile dockerd @{exec_path} flags=(attach_disconnected) {
         @{PROC}/sys/kernel/threads-max r,
         @{PROC}/sys/net/bridge/bridge-nf-call-ip*tables r,
         @{PROC}/sys/net/core/somaxconn r,
-        @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} rw,
+        @{PROC}/sys/net/ipv{4,6}/conf/*/disable_ipv{4,6} rw,
         @{PROC}/sys/net/ipv{4,6}/conf/docker@{int}/accept_ra rw,
         @{PROC}/sys/net/ipv{4,6}/ip_forward rw,
         @{PROC}/sys/net/ipv{4,6}/ip_local_port_range r,
-  owner @{PROC}/@{pids}/attr/current r,
-  owner @{PROC}/@{pids}/cgroup r,
-  owner @{PROC}/@{pids}/fd/ r,
-  owner @{PROC}/@{pids}/mountinfo r,
-  owner @{PROC}/@{pids}/net/ip_tables_names r,
-  owner @{PROC}/@{pids}/uid_map r,
+  owner @{PROC}/@{pid}/attr/current r,
+  owner @{PROC}/@{pid}/cgroup r,
+  owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/mountinfo r,
+  owner @{PROC}/@{pid}/net/ip_tables_names r,
+  owner @{PROC}/@{pid}/task/@{tid}/mountinfo r,
+  owner @{PROC}/@{pid}/uid_map r,
+
+  /dev/ r,
+  /dev/**/ r,
 
   include if exists <local/dockerd>
 }