feat(profiles): ensure we use which{,.debianutils} instead of which.

apparmor.d/abstractions/app/editor

@@ -13,7 +13,7 @@
   @{bin}/nvim                mrix,
   @{bin}/sensible-editor       mr,
   @{bin}/vim{,.*}            mrix,
-  @{bin}/which                rix,
+  @{bin}/which{,.debianutils} rix,
 
   /usr/share/nvim/{,**} r,
   /usr/share/terminfo/** r,

apparmor.d/groups/apt/apt-systemd-daily

@@ -37,7 +37,7 @@ profile apt-systemd-daily @{exec_path} {
   @{bin}/touch      rix,
   @{bin}/uniq       rix,
   @{bin}/wc         rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/xargs      rix,
 
   @{bin}/apt-config         rPx,

apparmor.d/groups/apt/aptitude-create-state-bundle

@@ -16,7 +16,7 @@ profile aptitude-create-state-bundle @{exec_path} {
   @{exec_path} r,
   @{sh_path}        rix,
 
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/tar        rix,
   @{bin}/bzip2      rix,
   @{bin}/gzip       rix,

apparmor.d/groups/browsers/brave-wrapper

@@ -23,7 +23,7 @@ profile brave-wrapper @{exec_path} {
   @{bin}/mkdir                 rix,
   @{bin}/readlink              rix,
   @{bin}/touch                 rix,
-  @{bin}/which                 rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{lib_dirs}/brave rPx,
 

apparmor.d/groups/browsers/chrome-wrapper

@@ -22,7 +22,7 @@ profile chrome-wrapper @{exec_path} flags=(attach_disconnected) {
   @{bin}/mkdir                 rix,
   @{bin}/readlink              rix,
   @{bin}/touch                 rix,
-  @{bin}/which                 rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{lib_dirs}/chrome   rPx,
 

apparmor.d/groups/browsers/msedge-wrapper

@@ -22,7 +22,7 @@ profile msedge-wrapper @{exec_path} flags=(attach_disconnected) {
   @{bin}/mkdir                 rix,
   @{bin}/readlink              rix,
   @{bin}/touch                 rix,
-  @{bin}/which                 rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{lib_dirs}/msedge   rPx,
 

apparmor.d/groups/cron/cron-apt-compat

@@ -22,7 +22,7 @@ profile cron-apt-compat @{exec_path} {
   @{bin}/dd                    rix,
   @{bin}/cksum                 rix,
   @{bin}/cut                   rix,
-  @{bin}/which                 rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/sleep                 rix,
 
   include if exists <local/cron-apt-compat>

apparmor.d/groups/cron/cron-apt-xapian-index

@@ -14,9 +14,8 @@ profile cron-apt-xapian-index @{exec_path} {
   @{exec_path} r,
   @{sh_path}        rix,
 
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/{,e}grep   rix,
-
   @{bin}/nice       rix,
   @{bin}/ionice     rix,
 

apparmor.d/groups/cron/cron-aptitude

@@ -17,7 +17,7 @@ profile cron-aptitude @{exec_path} {
   @{bin}/cp         rix,
   @{bin}/date       rix,
   @{bin}/basename   rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/dirname    rix,
   @{bin}/rm         rix,
   @{bin}/mv         rix,

apparmor.d/groups/cron/cron-mlocate

@@ -15,7 +15,7 @@ profile cron-mlocate @{exec_path} {
   @{exec_path} r,
   @{sh_path}        rix,
 
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/true       rix,
   @{bin}/flock      rix,
   @{bin}/nocache    rix,

apparmor.d/groups/cron/cron-plocate

@@ -15,7 +15,7 @@ profile cron-plocate @{exec_path} {
   @{exec_path} r,
   @{sh_path}        rix,
 
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/true       rix,
   @{bin}/flock      rix,
   @{bin}/nocache    rix,

apparmor.d/groups/cron/cron-popularity-contest

@@ -74,7 +74,7 @@ profile cron-popularity-contest @{exec_path} {
     @{bin}/mv         rix,
     @{bin}/rm         rix,
     @{bin}/touch      rix,
-    @{bin}/which      rix,
+    @{bin}/which{,.debianutils}  rix,
     @{sh_path}        rix,
 
     /var/log/ r,

apparmor.d/groups/display-manager/x11-xsession

@@ -34,7 +34,7 @@ profile x11-xsession @{exec_path} {
   @{bin}/tail       rix,
   @{bin}/tempfile   rix,
   @{bin}/touch      rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{bin}/dbus-update-activation-environment rCx -> dbus,
 

apparmor.d/groups/gnome/gdm-xsession

@@ -35,7 +35,7 @@ profile gdm-xsession @{exec_path} {
   @{bin}/tr              rix,
   @{bin}/truncate        rix,
   @{bin}/tty             rix,
-  @{bin}/which           rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/zsh             rix,
 
   @{bin}/dbus-update-activation-environment    rCx -> dbus,

apparmor.d/groups/kde/sddm-xsession

@@ -40,7 +40,7 @@ profile sddm-xsession @{exec_path} {
   @{bin}/tcsh       rix,
   @{bin}/tempfile   rix,
   @{bin}/touch      rix,
-  @{bin}/which{,.*} rix,
+  @{bin}/which{,.debianutils} rix,
   @{bin}/zsh        rix,
 
   @{bin}/dbus-update-activation-environment  rCx -> dbus,

apparmor.d/groups/network/openvpn

@@ -84,7 +84,7 @@ profile openvpn @{exec_path} flags=(attach_disconnected) {
     @{sh_path}                rix,
     @{bin}/cut                rix,
     @{bin}/ip                 rix,
-    @{bin}/which              rix,
+    @{bin}/which{,.debianutils}  rix,
     @{sbin}/xtables-nft-multi rix,
 
     /etc/iproute2/rt_tables r,

apparmor.d/groups/pacman/pacman

@@ -101,7 +101,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) {
   @{sbin}/update-grub                rPx,
   @{bin}/update-mime-database        rPx,
   @{bin}/vercmp                      rix,
-  @{bin}/which                       rix,
+  @{bin}/which{,.debianutils}        rix,
   @{bin}/xmlcatalog                  rix,
   @{lib}/systemd/systemd-*           rPx,
   @{lib}/ghc-@{version}/bin/ghc-pkg-@{version} rPx,

apparmor.d/groups/ubuntu/apport-gtk

@@ -52,7 +52,7 @@ profile apport-gtk @{exec_path} {
   @{bin}/systemctl              rCx -> systemctl,
   @{bin}/systemd-detect-virt    rPx,
   @{bin}/uname                  rix,
-  @{bin}/which                  rix,
+  @{bin}/which{,.debianutils}   rix,
   @{lib}/{,colord/}colord-sane  rPx,
   @{lib}/@{multiarch}/ld*.so*   rix,
   /usr/share/apport/root_info_wrapper rix,

apparmor.d/profiles-a-f/anyremote

@@ -41,7 +41,7 @@ profile anyremote @{exec_path} {
   @{bin}/tail       rix,
   @{bin}/tr         rix,
   @{bin}/wc         rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{bin}/convert-im6.q16 rCx -> imagemagic,
   @{bin}/killall         rCx -> killall,

apparmor.d/profiles-a-f/aspell-autobuildhash

@@ -20,7 +20,7 @@ profile aspell-autobuildhash @{exec_path} flags=(complain) {
   @{bin}/gzip                 rix,
   @{bin}/precat               rix,
   @{bin}/prezip-bin           rix,
-  @{bin}/which                rix,
+  @{bin}/which{,.debianutils} rix,
   @{bin}/zcat                 rix,
 
   @{bin}/dpkg-trigger         rPx,

apparmor.d/profiles-a-f/claws-mail

@@ -24,7 +24,7 @@ profile claws-mail @{exec_path} flags=(complain) {
   @{exec_path} mr,
 
   @{sh_path}        rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{bin}/gpg{,2}    rCx -> gpg,
   @{bin}/gpgsm      rCx -> gpg,

apparmor.d/profiles-g-l/ganyremote

@@ -30,7 +30,7 @@ profile ganyremote @{exec_path} {
   @{bin}/{,e}grep    rix,
   @{bin}/cut         rix,
   @{bin}/id          rix,
-  @{bin}/which       rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/tr          rix,
   @{bin}/{m,g,}awk   rix,
 

apparmor.d/profiles-g-l/gsmartcontrol-root

@@ -15,7 +15,7 @@ profile gsmartcontrol-root @{exec_path} {
   @{exec_path} r,
   @{sh_path}        rix,
 
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{bin}/pkexec     rCx -> pkexec,
 

apparmor.d/profiles-g-l/kanyremote

@@ -31,7 +31,7 @@ profile kanyremote @{exec_path} {
   @{bin}/{,e}grep   rix,
   @{bin}/cut        rix,
   @{bin}/id         rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/tr         rix,
   @{bin}/{m,g,}awk  rix,
   @{bin}/head       rix,

apparmor.d/profiles-g-l/kernel

@@ -33,7 +33,7 @@ profile kernel @{exec_path} {
   @{bin}/touch      rix,
   @{bin}/tr         rix,
   @{bin}/uname      rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{bin}/apt-config               rPx,
   @{bin}/dpkg                     rPx -> child-dpkg,

apparmor.d/profiles-m-r/mumble-overlay

@@ -16,7 +16,7 @@ profile mumble-overlay @{exec_path} {
   @{sh_path}        rix,
 
   @{bin}/file       rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{bin}/glxgears   rPx,
 

apparmor.d/profiles-m-r/openbox

@@ -58,7 +58,7 @@ profile openbox @{exec_path} {
     @{lib}/@{multiarch}/openbox-xdg-autostart rix,
 
     @{sh_path}        rix,
-    @{bin}/which      rix,
+    @{bin}/which{,.debianutils}   rix,
 
     # Apps allowed to run
     @{bin}/*                      rPUx,

apparmor.d/profiles-m-r/os-prober

@@ -51,7 +51,7 @@ profile os-prober @{exec_path} flags=(attach_disconnected) {
   @{bin}/udevadm           rPx,
   @{bin}/umount            rix,
   @{bin}/uname             rix,
-  @{bin}/which             rix,
+  @{bin}/which{,.debianutils}  rix,
   @{lib}/newns             rix,
   @{lib}/os-prober/*       rix,
   @{lib}/os-probes/{,**}   rix,

apparmor.d/profiles-m-r/pass

@@ -40,7 +40,7 @@ profile pass @{exec_path} {
   @{bin}/tr           ix,
   @{bin}/tree         ix,
   @{bin}/tty          ix,
-  @{bin}/which        ix,
+  @{bin}/which{,.debianutils}  ix,
 
   @{bin}/git             Cx -> git,
   @{bin}/gpg{2,}         Cx -> gpg,

apparmor.d/profiles-m-r/pokemmo

@@ -37,7 +37,7 @@ profile pokemmo @{exec_path} flags=(attach_disconnected) {
 
   @{bin}/java ix,
   @{bin}/perl ix,
-  @{bin}/which ix,
+  @{bin}/which{,.debianutils} ix,
   @{lib}/jvm/java-@{int}-openjdk/bin/java ix,
 
   # Installer

apparmor.d/profiles-m-r/protonmail-bridge-core

@@ -72,7 +72,7 @@ profile protonmail-bridge-core @{exec_path} flags=(attach_disconnected) {
     @{bin}/tail        rix,
     @{bin}/tree        rix,
     @{bin}/tty         rix,
-    @{bin}/which       rix,
+    @{bin}/which{,.debianutils}  rix,
 
          owner @{user_passwordstore_dirs}/ r,
          owner @{user_passwordstore_dirs}/.gpg-id r,

apparmor.d/profiles-s-z/ucf

@@ -33,7 +33,7 @@ profile ucf @{exec_path} {
   @{bin}/seq            rix,
   @{bin}/stat           rix,
   @{bin}/tr             rix,
-  @{bin}/which          rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{bin}/dpkg-query     rpx,
   @{bin}/dpkg-divert    rPx,

apparmor.d/profiles-s-z/update-pciids

@@ -24,7 +24,7 @@ profile update-pciids @{exec_path} {
   @{bin}/chmod      rix,
   @{bin}/echo       rix,
   @{bin}/cat        rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/bunzip2    rix,
   @{bin}/bzip2      rix,
   @{bin}/gzip       rix,

apparmor.d/profiles-s-z/uupdate

@@ -18,7 +18,7 @@ profile uupdate @{exec_path} flags=(complain) {
   @{sh_path}        rix,
 
   @{bin}/basename   rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/tr         rix,
   @{bin}/{,e}grep   rix,
   @{bin}/getopt     rix,

apparmor.d/profiles-s-z/xinit

@@ -35,7 +35,7 @@ profile xinit @{exec_path} {
   @{bin}/tail         rix,
   @{bin}/tempfile     rix,
   @{bin}/touch        rix,
-  @{bin}/which        rix,
+  @{bin}/which{,.debianutils}  rix,
   /etc/X11/xinit/xinitrc   rix,
   /etc/X11/xinit/xserverrc rix,