su & sudo: Ubuntu compatibility, Debian polishing

apparmor.d/profiles-s-z/sudo

@@ -1,6 +1,5 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
-# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -31,9 +30,9 @@ profile sudo @{exec_path} {
 
   ptrace (read),
   signal,
+  signal (send) set=(cont,hup) peer=su,
 
   @{exec_path} mr,
-  @{libexec}/sudo/** mr,
 
   # Shells to use
   /{usr/,}bin/{,b,d,rb}ash rpux,
@@ -43,12 +42,13 @@ profile sudo @{exec_path} {
   /{usr/,}{s,}bin/[a-z0-9]*           rPUx,
   /{usr/,}lib/cockpit/cockpit-askpass rPUx,
 
-  /etc/environment r,
-  /etc/machine-id r,
-  /etc/security/limits.d/{,*} r,
   /etc/sudo.conf r,
+
   /etc/sudoers r,
   /etc/sudoers.d/{,*} r,
+  /etc/environment r,
+  /etc/security/limits.d/{,*} r,
+  /etc/default/locale r,
 
   /var/log/sudo.log wk,
 
@@ -58,15 +58,21 @@ profile sudo @{exec_path} {
   owner @{run}/sudo/ts/* rwk,
         @{run}/faillock/{,*} rwk,
 
-  @{PROC}/@{pid}/fd/ r,
+  @{PROC}/@{pids}/fd/ r,
   @{PROC}/@{pids}/stat r,
-  @{PROC}/1/limits r,
 
   # File Inherit
   owner /dev/tty[0-9]* rw,
   owner @{HOME}/.xsession-errors w,
 
-  /dev/ r,
+  owner @{HOME}/.sudo_as_admin_successful rw,
+
+  @{run}/systemd/userdb/ r,
+  @{run}/systemd/userdb/io.systemd.DynamicUser rw,
+
+  @{PROC}/sys/kernel/random/boot_id r,
+
+#  /dev/ r,  # noise
   /dev/ptmx rw,
 
   include if exists <local/sudo>