feat(profiles): general update.

apparmor.d/groups/freedesktop/plymouthd

@@ -10,6 +10,7 @@ include <tunables/global>
 profile plymouthd @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
+  include <abstractions/dri-common>
 
   capability sys_admin,
   capability sys_tty_config,
@@ -37,12 +38,12 @@ profile plymouthd @{exec_path} {
   @{sys}/class/drm/ r,
   @{sys}/devices/pci[0-9]*/**/drm/card[0-9]/card[0-9]-{HDMI,VGA,LVDS,DP,eDP,Virtual}-*/uevent r,
   @{sys}/devices/pci[0-9]*/**/drm/card[0-9]/uevent r,
+  @{sys}/devices/pci[0-9]*/**/drm/renderD128/uevent r,
   @{sys}/devices/virtual/tty/console/active r,
   @{sys}/firmware/acpi/bgrt/{,*} r,
 
   @{PROC}/cmdline r,
 
-  /dev/dri/card[0-9]* rw,
   /dev/ptmx rw,
   /dev/tty[0-9]* rw,
 

apparmor.d/groups/ubuntu/do-release-upgrade

@@ -15,14 +15,18 @@ profile do-release-upgrade @{exec_path} {
   include <abstractions/python>
   include <abstractions/ssl_certs>
 
+  capability net_admin,
+
   network inet dgram,
   network inet6 dgram,
   network inet stream,
   network inet6 stream,
+  network netlink raw,
 
   @{exec_path} mr,
 
   /{usr/,}bin/dpkg         rPx -> child-dpkg,
+  /{usr/,}bin/ischroot     rix,
   /{usr/,}bin/lsb_release  rPx -> lsb_release,
 
   /usr/share/distro-info/*.csv r,
@@ -31,10 +35,11 @@ profile do-release-upgrade @{exec_path} {
   /etc/machine-id r,
   /etc/update-manager/{,**} r,
 
-  /var/lib/update-manager/meta-release-* rw,
+  /var/lib/update-manager/* rw,
   /var/cache/apt/pkgcache.bin{,.*} rw,
 
   owner @{PROC}/@{pid}/fd/ r,
+        @{PROC}/@{pids}/mountinfo r,
 
   include if exists <local/do-release-upgrade>
 }