feat(profile): improve integration with ubuntu.

apparmor.d/groups/gpg/gpg

@@ -29,6 +29,7 @@ profile gpg @{exec_path} {
   @{lib}/{,gnupg/}scdaemon rPx,
 
   /usr/share/terminfo/** r,
+  /usr/share/keyrings/** rw,  #aa:only apt
   /usr/share/pacman/keyrings/** r,  #aa:only pacman
 
   /etc/inputrc r,

apparmor.d/groups/grub/grub-mkconfig

@@ -27,7 +27,7 @@ profile grub-mkconfig @{exec_path} flags=(attach_disconnected) {
   @{bin}/cut                  rix,
   @{bin}/date                 rix,
   @{bin}/dirname              rix,
-  @{sbin}/dmsetup             rPUx,
+  @{sbin}/dmsetup             rPx,
   @{bin}/dpkg                 rPx,
   @{bin}/find                 rix,
   @{bin}/findmnt              rPx,

apparmor.d/groups/grub/grub-probe

@@ -36,6 +36,8 @@ profile grub-probe @{exec_path} {
   /dev/**/ r,
   /dev/mapper/control w,
 
+  deny mqueue (read, getattr) type=posix /,
+
   include if exists <local/grub-probe>
 }
 

apparmor.d/groups/network/NetworkManager

@@ -71,6 +71,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
   @{bin}/kmod                                                rPx,
   @{bin}/netconfig                                          rPUx,
   @{sbin}/resolvconf                                         rPx,
+  @{bin}/resolvectl                                          rPx,
   @{bin}/systemctl                                           rCx -> systemctl,
   @{lib}/{,NetworkManager/}nm-daemon-helper                  rPx,
   @{lib}/{,NetworkManager/}nm-dhcp-helper                    rPx,

apparmor.d/profiles-a-f/blkdeactivate

@@ -15,7 +15,7 @@ profile blkdeactivate @{exec_path} flags=(complain) {
   @{exec_path} rm,
 
   @{sh_path}             rix,
-  @{sbin}/dmsetup        rPUx,
+  @{sbin}/dmsetup        rPx,
   @{bin}/{,e}grep        rix,
   @{bin}/touch           rix,
   @{bin}/lsblk           rPx,

apparmor.d/profiles-m-r/initramfs-hooks

@@ -16,6 +16,8 @@ profile initramfs-hooks @{exec_path} {
 
   @{sh_path}                               rix,
   @{coreutils_path}                        rix,
+  @{bin}/cpio                               ix,
+  @{bin}/dpkg                               Cx -> child-dpkg,
   @{bin}/fc-cache                           ix,
   @{bin}/ischroot                           Px,
   @{bin}/ldd                                Cx -> ldd,
@@ -25,6 +27,9 @@ profile initramfs-hooks @{exec_path} {
   @{lib}/initramfs-tools/bin/busybox        ix,
   @{lib}/klibc/bin/fstype                   ix,
   @{sbin}/blkid                             Px,
+  @{sbin}/cryptsetup                        PUx,
+  @{sbin}/dmsetup                           Px,
+  @{sbin}/iucode_tool                       ix,
   /usr/share/mdadm/mkconf                   Px,
 
   @{bin}/* mr,