feat(profile): various update for ubuntu.

apparmor.d/groups/apt/apt

@@ -53,6 +53,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
        peer=(name="{:*,org.freedesktop.DBus}"),
 
   @{exec_path} mr,
+  @{python_path} mr,
 
   @{bin}/ r,
 

apparmor.d/groups/apt/apt-methods-gpgv

@@ -84,6 +84,7 @@ profile apt-methods-gpgv @{exec_path} {
   owner @{tmp}/apt-key-gpghome.*/ rw,
   owner @{tmp}/apt-key-gpghome.*/** rwkl -> /tmp/apt-key-gpghome.*/**,
   owner @{tmp}/apt.{conf,sig,data}.* rw,
+  owner @{tmp}/apt.@{rand6}.gpg rw,
 
   @{PROC}/@{pid}/fd/ r,
 

apparmor.d/groups/apt/dpkg

@@ -37,7 +37,6 @@ profile dpkg @{exec_path} {
   @{pager_path}      rPx -> child-pager,
 
   # Package maintainer's scripts
-  # Move it to a child profile once more transitions will be available
   /var/lib/dpkg/info/*.{config,templates} rPUx,
   /var/lib/dpkg/info/*.{preinst,postinst} rPUx,
   /var/lib/dpkg/info/*.{prerm,postrm}     rPUx,

apparmor.d/groups/apt/dpkg-preconfigure

@@ -23,14 +23,17 @@ profile dpkg-preconfigure @{exec_path} {
   @{bin}/{,e}grep   rix,
   @{bin}/{,g,m}awk  rix,
   @{bin}/cat        rix,
+  @{bin}/debconf-escape rix,
   @{bin}/dialog     rix,
   @{bin}/expr       rix,
   @{bin}/locale     rix,
+  @{bin}/readlink   rix,
   @{bin}/sed        rix,
   @{bin}/sort       rix,
   @{bin}/stty       rix,
   @{bin}/tr         rix,
 
+  @{bin}/findmnt              rPx,
   @{bin}/dpkg                 rPx -> child-dpkg,
   @{bin}/apt-extracttemplates rPx,
   @{bin}/whiptail             rPx,
@@ -40,9 +43,12 @@ profile dpkg-preconfigure @{exec_path} {
 
   /etc/debconf.conf r,
   /etc/default/grub r,
+  /etc/default/mdadm r,
   /etc/inputrc r,
   /etc/locale.gen r,
+  /etc/mdadm/mdadm.conf r,
   /etc/shadow r,
+  /etc/ssh/sshd_config r,
 
   /var/lib/locales/supported.d/{,*} r,
 

apparmor.d/groups/filesystem/lvm

@@ -23,6 +23,7 @@ profile lvm @{exec_path} flags=(attach_disconnected) {
 
   ptrace (read),
 
+  mqueue getattr type=posix /,
   mqueue r type=posix /,
 
   @{exec_path} rm,

apparmor.d/groups/firewall/firewalld

@@ -40,7 +40,7 @@ profile firewalld @{exec_path} flags=(attach_disconnected) {
   @{bin}/kmod                     rix,
   @{bin}/modprobe                 rix,
   @{bin}/xtables-legacy-multi     rix,
-  @{bin}/xtables-nft-multi        rix,
+  @{bin}/xtables-nft-multi       rmix,
 
   /usr/local/lib/@{python_name}/dist-packages/ r,
 

apparmor.d/groups/polkit/polkitd

@@ -53,6 +53,7 @@ profile polkitd @{exec_path} flags=(attach_disconnected) {
         /var/lib/polkit{,-1}/localauthority/{,**} r,
   owner /var/lib/polkit{,-1}/.cache/ rw,
 
+  @{att}/@{run}/systemd/notify w,
   @{att}/@{run}/systemd/userdb/io.systemd.DynamicUser rw,
   @{att}/@{run}/systemd/userdb/io.systemd.Multiplexer rw,
 

apparmor.d/groups/snap/snapd

@@ -108,7 +108,7 @@ profile snapd @{exec_path} {
   /etc/modules-load.d/*snap* rw,
   /etc/systemd/system/{,**/} r,
   /etc/systemd/system/snap* rw,
-  /etc/systemd/user/{,**/} r,
+  /etc/systemd/user/{,**/} rw,
   /etc/systemd/user/**/*snap* rw,
   /etc/systemd/user/*snap* rw,
   /etc/udev/rules.d/{,*snap*} rw,

apparmor.d/groups/utils/login

@@ -59,12 +59,13 @@ profile login @{exec_path} flags=(attach_disconnected) {
 
   owner @{user_cache_dirs}/motd.legal-displayed rw,
 
+  @{att}/@{run}/systemd/sessions/@{int}.ref w,
+
   @{run}/credentials/getty@tty@{int}.service/ r,
   @{run}/dbus/system_bus_socket rw,
   @{run}/faillock/@{user} rwk,
   @{run}/motd.d/{,*} r,
   @{run}/motd.dynamic{,.new} rw,
-  @{run}/systemd/sessions/*.ref rw,
 
         @{PROC}/@{pids}/cgroup r,
         @{PROC}/1/limits r,