feat(profile): add support for terminal in flatpak app.

- Sandbox's security is managed by flatpak
- The app stays confined under the (not really strict) flatpak-app profile
- User shell runs unconfined (under the `user_unconfined` profile)

Running terminal as a flatpak app provides less security than as a normal app.
This is because the shell runs as user_unconfined profile that will purposely
not transition to any other profile. While a shell from a classic terminal will
transition to any profile it can, and thus would get restricted. In other words,
running `apt` inside flatpak would run under the `user_unconfined` while it
would use the `apt` profile outside the sandbox.

fix #314

apparmor.d/profiles-a-f/flatpak-app

@@ -43,10 +43,14 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
   ptrace (read),
 
   signal (receive) set=(int) peer=flatpak-portal,
+  signal (receive) set=(int) peer=flatpak-session-helper,
 
   @{bin}/**                            rmix,
   @{lib}/**                            rmix,
   /app/**                              rmix,
+  /usr/plugins/**                      rmix,
+  /usr/share/flatpak/triggers/*        rix,
+  /usr/share/runtime/**                rmix,
   /var/lib/flatpak/app/*/**/@{bin}/**  rmix,
   /var/lib/flatpak/app/*/**/@{lib}/**  rmix,
 
@@ -60,8 +64,6 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
 
   /var/lib/flatpak/app/{,**} r,
 
-  /usr/share/flatpak/triggers/*     rix,
-
   /usr/.ref rk,
 
   /etc/**/ rw,

apparmor.d/profiles-a-f/flatpak-session-helper

@@ -13,19 +13,25 @@ profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) {
   include <abstractions/nameservice-strict>
   include <abstractions/p11-kit>
   include <abstractions/ssl_certs>
+  include <abstractions/consoles>
 
+  signal (send) set=(hup int) peer=user_unconfined,
   signal (send) set=(int) peer=@{p_systemd},
+  signal (send) set=(int) peer=flatpak-app,
 
   #aa:dbus own bus=session name=org.freedesktop.Flatpak
 
   @{exec_path} mr,
 
-  @{sh_path}                           rix,
+  @{shells_path}                       rUx -> user_unconfined,
   @{bin}/dbus-monitor                 rPUx,
+  @{bin}/env                           rix,
   @{bin}/flatpak                       rPx,
-  @{bin}/ps                            rPx,
+  @{bin}/test                          rix,
+  @{bin}/getent                        rix,
   @{bin}/p11-kit                       rix,
   @{bin}/pkexec                        rPx, # TODO: too wide, rCx.
+  @{bin}/ps                            rPx,
   @{lib}/p11-kit/p11-kit-remote        rix,
   @{lib}/p11-kit/p11-kit-server        rix,
   /var/lib/flatpak/app/*/**/@{bin}/**  rPx -> flatpak-app,
@@ -36,5 +42,7 @@ profile flatpak-session-helper @{exec_path} flags=(attach_disconnected) {
   
   owner @{PROC}/@{pids}/fd/ r,
 
+  /dev/ptmx rw,
+
   include if exists <local/flatpak-session-helper>
 }