feat(profile): start using the sudo abstraction.

apparmor.d/profiles-s-z/sudo

@@ -8,27 +8,16 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = @{bin}/sudo
-#@{bin}/su
-profile sudo @{exec_path} {
+profile sudo @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/app-launcher-root>
-  include <abstractions/authentication>
-  include <abstractions/bus-system>
-  include <abstractions/consoles>
-  include <abstractions/nameservice-strict>
-  include <abstractions/wutmp>
-# include <pam/mappings>
+  include <abstractions/sudo>
 
-  capability audit_write,
   capability chown,
   capability dac_override,
   capability dac_read_search,
   capability mknod,
-  capability net_admin,
-  capability setgid,
-  capability setuid,
   capability sys_ptrace,
-  capability sys_resource,
 
   network inet dgram,
   network inet6 dgram,
@@ -37,7 +26,7 @@ profile sudo @{exec_path} {
   ptrace (read),
 
   signal (send,receive) peer=cockpit-bridge,
-  signal (send) peer=unconfined,
+  signal (send) peer=@{systemd},
   signal (send) set=(cont,hup) peer=su,
   signal (send) set=(winch),
 
@@ -51,21 +40,12 @@ profile sudo @{exec_path} {
          member={JobRemoved,StartTransientUnit},
 
   @{exec_path} mr,
-  @{lib}/sudo/** mr,
 
   @{bin}/@{shells}                 rUx,
   @{lib}/**                        rPUx,
   /opt/*/**                        rPUx,
   /snap/snapd/@{int}@{bin}/snap    rPUx,
 
-  @{etc_ro}/environment r,
-  @{etc_ro}/security/limits.d/{,*} r,
-  /etc/default/locale r,
-  /etc/machine-id r,
-  /etc/sudo.conf r,
-  /etc/sudoers r,
-  /etc/sudoers.d/{,*} r,
-
         /var/db/sudo/lectured/ r,
         /var/lib/extrausers/shadow r,
         /var/lib/sudo/lectured/ r,
@@ -76,7 +56,6 @@ profile sudo @{exec_path} {
   owner /var/lib/sudo/lectured/* rw,
 
   owner @{HOME}/.sudo_as_admin_successful rw,
-  owner @{HOME}/.xsession-errors w,
 
         @{run}/ r,
         @{run}/faillock/{,*} rwk,
@@ -85,19 +64,5 @@ profile sudo @{exec_path} {
   owner @{run}/sudo/ts/ rw,
   owner @{run}/sudo/ts/* rwk,
 
-  @{PROC}/@{pids}/cgroup r,
-  @{PROC}/@{pids}/fd/ r,
-  @{PROC}/@{pids}/loginuid r,
-  @{PROC}/@{pids}/stat r,
-  @{PROC}/1/limits r,
-  @{PROC}/sys/kernel/seccomp/actions_avail r,
-
-        /dev/ r,    # interactive login
-        /dev/ptmx rwk,
-  owner /dev/tty rwk,
-  owner /dev/tty@{int} rw,
-
-  deny @{user_share_dirs}/gvfs-metadata/* r,
-
   include if exists <local/sudo>
 }