feat(profiles): general update.

apparmor.d/profiles-s-z/snap-update-ns

@@ -21,6 +21,7 @@ profile snap-update-ns @{exec_path} {
   @{run}/snapd/ns/{,**} rw,
 
   @{sys}/fs/cgroup/{,**/} r,
+  @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/snap*.service/cgroup.freeze r,
   @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
 
   @{PROC}/@{pids}/cgroup r,

apparmor.d/profiles-s-z/snapd

@@ -110,6 +110,7 @@ profile snapd @{exec_path} {
   /tmp/syscheck-squashfs-[0-9]* rw,
   /tmp/read-file[0-9]*/{,**} rw,
 
+  / r,
   /home/ r,
   @{HOME}/ r,
   @{HOME}/snap/{,**} rw,

apparmor.d/profiles-s-z/steam

@@ -88,7 +88,7 @@ profile steam @{exec_path} {
   @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam rix,
   @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime-heavy.sh rix,
   @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime{,-heavy}/{setup,run}.sh  rix,
-  @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime/{amd64,i386}/usr/bin/* rix,
+  @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime{,-heavy}/{amd64,i386}/usr/bin/* rix,
   @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steam-runtime/{usr/,}lib{exec,}/**.so*  mr,
   @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steamwebhelper rix,
   @{user_share_dirs}/Steam/ubuntu[0-9]*_{32,64}/steamwebhelper.sh rix,
@@ -98,6 +98,7 @@ profile steam @{exec_path} {
   /usr/share/terminfo/x/xterm-256color r,
   /usr/share/themes/{,**} r,
   /usr/share/X11/{,**} r,
+  /usr/share/zenity/* r,
 
   /etc/lsb-release r,
   /etc/udev/udev.conf r,

apparmor.d/profiles-s-z/sudo

@@ -63,6 +63,7 @@ profile sudo @{exec_path} {
   /etc/sudoers.d/{,*} r,
 
         /var/log/sudo.log wk,
+        /var/lib/sudo/lectured/ r,
   owner /var/lib/sudo/lectured/* rw,
 
   owner @{HOME}/.sudo_as_admin_successful rw,

apparmor.d/profiles-s-z/which

@@ -13,6 +13,8 @@ profile which @{exec_path} flags=(complain) {
 
   @{exec_path} mr,
 
+  /{usr/,}bin/{,ba,da}sh  rix,
+
   /{usr/,}{local/,}{s,}bin/ r,
   /{usr/,}lib/go-*/bin/ r,
   /{usr/,}{local/,}games/ r,

apparmor.d/profiles-s-z/wireplumber

@@ -12,6 +12,7 @@ profile wireplumber @{exec_path} {
   include <abstractions/audio>
   include <abstractions/devices-usb>
   include <abstractions/nameservice-strict>
+  include <abstractions/video>
 
   network bluetooth raw,
   network bluetooth seqpacket,
@@ -34,22 +35,22 @@ profile wireplumber @{exec_path} {
   @{run}/systemd/users/@{uid} r,
 
   @{run}/udev/data/+sound:card[0-9]* r, # For sound
-  @{run}/udev/data/c81:[0-9]*  r,       # For video4linux
   @{run}/udev/data/c116:[0-9]* r,       # for ALSA
+  @{run}/udev/data/c50[0-9]:[0-9]* r,
+  @{run}/udev/data/c81:[0-9]*  r,       # For video4linux
 
   @{sys}/bus/ r,
   @{sys}/class/ r,
   @{sys}/class/sound/ r,
-  @{sys}/class/video4linux/ r,
   @{sys}/devices/**/sound/**/pcm_class r,
   @{sys}/devices/**/sound/**/uevent r,
   @{sys}/devices/pci[0-9]*/**/modalias r,
   @{sys}/devices/pci[0-9]*/**/video4linux/video[0-9]*/uevent r,
   @{sys}/devices/system/cpu/possible r,
-  @{sys}/devices/virtual/dmi/id/{sys_vendor,product_version,product_name,board_vendor,bios_vendor} r,
+  @{sys}/devices/**/device:*/**/path r,
 
+  /dev/media[0-9]* rw,
   /dev/snd/ r,
-  /dev/video[0-9]* rw,
 
   include if exists <local/wireplumber>
 }