update apparmor profiles

apparmor.d/groups/apt/apt-forktracer

@@ -0,0 +1,40 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2021 Mikhail Morfikov
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/apt-forktracer
+profile apt-forktracer @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/python>
+  include <abstractions/apt-common>
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/ r,
+  /{usr/,}bin/dpkg rPx -> child-dpkg,
+
+  /usr/share/apt-forktracer/{,**} r,
+
+  /var/lib/apt/lists/ r,
+  /var/lib/apt/lists/*_InRelease r,
+
+  /usr/share/distro-info/debian.csv r,
+
+  owner @{PROC}/@{pid}/fd/ r,
+
+  /var/lib/dbus/machine-id r,
+  /etc/machine-id r,
+
+  include if exists <local/apt-forktracer>
+}

apparmor.d/groups/apt/apt-key

@@ -59,6 +59,7 @@ profile apt-key @{exec_path} {
     include <abstractions/base>
     include <abstractions/consoles>
     include <abstractions/ssl_certs>
+    include <abstractions/nameservice-strict>
 
     network inet dgram,
     network inet6 dgram,

apparmor.d/groups/apt/apt-methods-gpgv

@@ -78,6 +78,10 @@ profile apt-methods-gpgv @{exec_path} {
 
   @{PROC}/@{pid}/fd/ r,
 
+  # Local keyring storage
+  /etc/keyrings/ r,
+  /etc/keyrings/*.gpg r,
+
   # For package building
   @{BUILD_DIR}/** rwkl -> @{BUILD_DIR}/**,
 

apparmor.d/groups/apt/usr.sbin.apt-cacher-ng

@@ -20,7 +20,7 @@ profile apt-cacher-ng /usr/sbin/apt-cacher-ng flags=(complain) {
   /var/lib/apt-cacher-ng/** r,
   /{,var/}run/apt-cacher-ng/* rw,
   @{APT_CACHER_NG_CACHE_DIR}/ r,
-  @{APT_CACHER_NG_CACHE_DIR}/** rw,
+  @{APT_CACHER_NG_CACHE_DIR}/** rwl,
   /var/log/apt-cacher-ng/ r,
   /var/log/apt-cacher-ng/* rw,
   /{,var/}run/systemd/notify w,