feat(profile): add dpkg-script-tmp.

apparmor.d/groups/apt/deb-systemd-invoke

@@ -21,7 +21,7 @@ profile deb-systemd-invoke @{exec_path} {
 
   @{sh_path} rix,
   @{bin}/systemctl  rix,
-  @{bin}/systemd-tty-ask-password-agent rPx,
+  @{bin}/systemd-tty-ask-password-agent Px,
 
   include if exists <local/deb-systemd-invoke>
 }

apparmor.d/groups/apt/dpkg-architecture

@@ -16,10 +16,9 @@ profile dpkg-architecture @{exec_path} {
   capability dac_read_search,
 
   @{exec_path} r,
-  /usr/bin/perl r,
 
-  @{bin}/{,@{multiarch}-}gcc-[0-9]* rix,
+  @{bin}/{,@{multiarch}-}gcc-[0-9]*  ix,
-  @{lib}/llvm-[0-9]*/bin/clang      rix,
+  @{lib}/llvm-[0-9]*/bin/clang       ix,
 
   @{bin}/ccache                     rCx -> ccache,
   @{bin}/dpkg                       rPx -> child-dpkg,
@@ -28,9 +27,7 @@ profile dpkg-architecture @{exec_path} {
 
   /etc/debian_version r,
 
-  # file_inherit
+  audit owner @{tmp}/* rw,
-  owner @{tmp}/* rw,
-
 
   profile ccache {
     include <abstractions/base>

apparmor.d/groups/apt/dpkg-db-backup

@@ -0,0 +1,42 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/dpkg/dpkg-db-backup
+profile dpkg-db-backup @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/common/apt>
+  include <abstractions/nameservice-strict>
+
+  @{exec_path} mr,
+
+  @{sh_path}       rix,
+  @{bin}/basename  rix,
+  @{bin}/cmp       rix,
+  @{bin}/cp        rix,
+  @{bin}/date      rix,
+  @{bin}/dirname   rix,
+  @{bin}/gzip      rix,
+  @{bin}/mv        rix,
+  @{bin}/rm        rix,
+  @{bin}/savelog   rix,
+  @{bin}/tar       rix,
+  @{bin}/touch     rix,
+
+  /usr/share/dpkg/{,**} r,
+
+  /var/lib/dpkg/ r,
+  /var/lib/dpkg/alternatives/{,*} r,
+  /var/lib/dpkg/diversions r,
+  /var/lib/dpkg/statoverride r,
+
+  /var/backups/{,**} rw,
+
+  include if exists <local/dpkg-db-backup>
+}
+
+# vim:syntax=apparmor

apparmor.d/groups/apt/dpkg-maintscript-helper

@@ -13,9 +13,9 @@ profile dpkg-maintscript-helper @{exec_path} {
 
   @{exec_path} mr,
 
-  @{sh_path} rix,
+  @{sh_path}       rix,
-  @{bin}/basename rix,
+  @{bin}/basename  rix,
-  @{bin}/dpkg rCx -> dpkg,
+  @{bin}/dpkg      rCx -> dpkg,
 
   /usr/share/dpkg/sh/* r,
 

apparmor.d/groups/apt/dpkg-script-tmp

@@ -0,0 +1,53 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = /var/lib/dpkg/tmp.ci/@{dpkg_script_ext}
+profile dpkg-script-tmp @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+  include <abstractions/consoles>
+
+  @{exec_path} mrix,
+
+  @{sh_path}                      rix,
+  @{coreutils_path}               rix,
+  @{bin}/run-parts                rix,
+  @{bin}/deb-systemd-invoke        Px,
+  @{bin}/dpkg                      Px,
+  @{bin}/dpkg-divert               Px,
+  @{bin}/dpkg-maintscript-helper   Px,
+  @{bin}/kmod                      Cx -> kmod,
+  @{bin}/systemctl                 Cx -> systemctl,
+
+  /etc/kernel/preinst.d/*-microcode ix,
+
+  @{lib}/modules/*/.fresh-install w,
+
+  profile kmod {
+    include <abstractions/base>
+    include <abstractions/app/kmod>
+
+    include if exists <local/dpkg-script-tmp_kmod>
+  }
+
+  profile systemctl {
+    include <abstractions/base>
+    include <abstractions/app/systemctl>
+
+    capability net_admin,
+    capability sys_ptrace,
+    capability sys_resource,
+
+    @{bin}/systemd-tty-ask-password-agent Px,
+
+    include if exists <local/dpkg-script-tmp_systemctl>
+  }
+
+  include if exists <local/dpkg-script-tmp>
+}
+
+# vim:syntax=apparmor

apparmor.d/groups/apt/dpkg-vendor

@@ -13,7 +13,6 @@ profile dpkg-vendor @{exec_path} {
   include <abstractions/perl>
 
   @{exec_path} r,
-  /usr/bin/perl r,
 
   /etc/dpkg/origins/* r,
 

dists/flags/main.flags

@@ -86,11 +86,13 @@ dmsetup complain
 dockerd attach_disconnected,complain
 dolphin complain
 downloadhelper complain
+dpkg-db-backup complain
 dpkg-maintscript-helper complain
 dpkg-script-apparmor complain
 dpkg-script-kmod complain
 dpkg-script-linux complain
 dpkg-script-systemd complain
+dpkg-script-tmp complain
 dpkg-scripts complain
 drkonqi complain
 drkonqi-coredump-cleanup complain