feat(profile): general update.

apparmor.d/profiles-m-r/pkexec

@@ -16,20 +16,21 @@ profile pkexec @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/wutmp>
 
-  signal (send) set=(term, kill) peer=polkit-agent-helper,
-
   capability audit_write,
   capability dac_read_search,
+  capability net_admin,
   capability setgid,  # gdbus
   capability setuid,  # gmain
   capability sys_ptrace,
   capability sys_resource,
   audit deny capability sys_nice,
 
-  ptrace (read),
-
   network netlink raw,
 
+  signal (send) set=(term, kill) peer=polkit-agent-helper,
+
+  ptrace (read),
+
   dbus (send) bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
        interface=org.freedesktop.DBus.Properties
        member=GetAll
@@ -61,20 +62,21 @@ profile pkexec @{exec_path} {
   @{lib}/update-notifier/package-system-locked  rPx,
   /usr/share/apport/apport-gtk rPx,
 
-  /etc/shells r,
   @{etc_ro}/environment r,
-  /etc/default/locale r,
   @{etc_ro}/security/limits.d/{,*} r,
+  /etc/default/locale r,
+  /etc/shells r,
 
         @{PROC}/@{pids}/stat r,
   owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/loginuid r,
 
   # file_inherit
   owner /dev/tty@{int} rw,
   owner @{HOME}/.xsession-errors w,
 
   # Silencer
-  deny @{user_share_dirs}/gvfs-metadata/* r,
+deny @{user_share_dirs}/gvfs-metadata/* r,
 
   include if exists <local/pkexec>
 }