feat(profile): upgrade cockpit profiles.

apparmor.d/groups/virt/cockpit-certificate-helper

@@ -21,6 +21,7 @@ profile cockpit-certificate-helper @{exec_path} {
   @{bin}/openssl  rix,
   @{bin}/rm       rix,
   @{bin}/sscg     rix,
+  @{bin}/sync     rix,
   @{bin}/tr       rix,
 
   /etc/machine-id r,

apparmor.d/groups/virt/cockpit-desktop

@@ -10,6 +10,8 @@ include <tunables/global>
 profile cockpit-desktop @{exec_path} {
   include <abstractions/base>
 
+  userns,
+
   @{exec_path} mr,
 
   include if exists <local/cockpit-desktop>

apparmor.d/groups/virt/cockpit-tls

@@ -17,6 +17,9 @@ profile cockpit-tls @{exec_path} flags=(attach_disconnected) {
 
   /etc/cockpit/ws-certs.d/{,**} r,
 
+  @{att}/@{run}/cockpit/wsinstance/https@@{hex64}.sock r,
+  @{att}/@{run}/cockpit/wsinstance/https-factory.sock rw,
+
   owner @{run}/cockpit/tls/{,**} rw,
 
   include if exists <local/cockpit-tls>

apparmor.d/groups/virt/cockpit-ws

@@ -7,7 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{exec_path} = @{lib}/cockpit/cockpit-ws
-profile cockpit-ws @{exec_path} {
+profile cockpit-ws @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
@@ -21,6 +21,8 @@ profile cockpit-ws @{exec_path} {
   /usr/share/pixmaps/{,**} r,
   /etc/cockpit/ws-certs.d/ r,
 
+  @{run}/cockpit/wsinstance/https@@{hex64}.sock r,
+
   owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/fd/ r,