fix(profile): apply fixes raised by tests

apparmor.d/abstractions/bus/org.freedesktop.Avahi

@@ -26,6 +26,11 @@
        member={ItemNew,AllForNow,CacheExhausted}
        peer=(name="@{busname}", label="@{p_avahi_daemon}"),
 
+  dbus receive bus=system path=/
+       interface=org.freedesktop.Avahi.Server
+       member=StateChanged
+       peer=(name=@{busname},  label="@{p_avahi_daemon}"),
+
   include if exists <abstractions/bus/org.freedesktop.Avahi.d>
 
 # vim:syntax=apparmor

apparmor.d/abstractions/bus/org.freedesktop.systemd1

@@ -8,7 +8,7 @@
 
   dbus send bus=session path=/org/freedesktop/systemd1
        interface=org.freedesktop.systemd1.Manager
-       member={GetUnit,StartUnit,StartTransientUnit}
+       member={GetUnit,GetUnitByPIDFD,StartUnit,StartTransientUnit}
        peer=(name=org.freedesktop.systemd1, label="@{p_systemd}"),
 
   dbus send bus=system path=/org/freedesktop/systemd1

apparmor.d/abstractions/common/electron

@@ -75,6 +75,7 @@
 
         @{PROC}/ r,
         @{PROC}/@{pid}/stat r,
+        @{PROC}/@{pid}/task/@{tid}/status r,
         @{PROC}/sys/fs/inotify/max_user_watches r,
         @{PROC}/sys/kernel/yama/ptrace_scope r,
   owner @{PROC}/@{pid}/cgroup r,
@@ -88,7 +89,6 @@
   owner @{PROC}/@{pid}/statm r,
   owner @{PROC}/@{pid}/task/ r,
   owner @{PROC}/@{pid}/task/@{tid}/stat r,
-  owner @{PROC}/@{pid}/task/@{tid}/status r,
   owner @{PROC}/@{pid}/uid_map w, # If kernel.unprivileged_userns_clone = 1
 
   deny @{user_share_dirs}/gvfs-metadata/* r,

apparmor.d/groups/freedesktop/xdg-user-dirs-gtk-update

@@ -12,14 +12,19 @@ profile xdg-user-dirs-gtk-update @{exec_path} {
   include <abstractions/bus-accessibility>
   include <abstractions/bus-session>
   include <abstractions/bus/org.gtk.vfs.MountTracker>
-  include <abstractions/gtk>
+  include <abstractions/dconf-write>
+  include <abstractions/desktop>
 
   @{exec_path} mr,
 
+  @{bin}/xdg-user-dirs-update Px,
+
   owner @{user_config_dirs}/gtk-3.0/bookmarks* rw,
   owner @{user_config_dirs}/user-dirs.dirs r,
   owner @{user_config_dirs}/user-dirs.locale r,
 
+  owner @{tmp}/dirs-@{rand6} rw,
+
   include if exists <local/xdg-user-dirs-gtk-update>
 }
 

apparmor.d/groups/systemd/systemd-machine-id-setup

@@ -31,6 +31,7 @@ profile systemd-machine-id-setup @{exec_path} flags=(attach_disconnected) {
   /etc/machine-id rw,
   /var/ r,
 
+        @{PROC}/@{pid}/fdinfo/@{int} r,
         @{PROC}/1/environ r,
         @{PROC}/cmdline r,
         @{PROC}/sys/kernel/osrelease r,

apparmor.d/groups/ubuntu/update-notifier

@@ -85,7 +85,6 @@ profile update-notifier @{exec_path} {
   profile systemctl {
     include <abstractions/base>
     include <abstractions/app/systemctl>
-    include <abstractions/bus-system>
 
     dbus send bus=system path=/org/freedesktop/systemd1
          interface=org.freedesktop.systemd1.Manager

apparmor.d/groups/ubuntu/update-notifier-crash

@@ -9,17 +9,28 @@ include <tunables/global>
 @{exec_path} = @{lib}/update-notifier/update-notifier-crash
 profile update-notifier-crash @{exec_path} {
   include <abstractions/base>
+  include <abstractions/nameservice-strict>
 
   @{exec_path} mr,
 
-  @{bin}/systemctl Cx -> systemctl,
-
+  @{bin}/{,e}grep                       ix,
+  @{bin}/groups                         Px,
+  @{bin}/systemctl                      Cx -> systemctl,
+  @{bin}/which{,.debianutils}           ix,
+  @{sh_path}                            mr,
   /usr/share/apport/apport-checkreports Px,
 
+  owner @{HOME}/ r,
+
   profile systemctl {
     include <abstractions/base>
     include <abstractions/app/systemctl>
 
+    dbus send bus=system path=/org/freedesktop/systemd1
+        interface=org.freedesktop.systemd1.Manager
+        member=GetUnitFileState
+        peer=(name=org.freedesktop.systemd1, label="@{p_systemd}"),
+
     include if exists <local/update-notifier-crash_systemctl>
   }
 

apparmor.d/profiles-a-f/dracut-install

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{lib}/dracut/dracut-install
 profile dracut-install @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
 
   @{exec_path} mr,
 

apparmor.d/profiles-m-r/mdadm

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{sbin}/mdadm
 profile mdadm @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
   include <abstractions/disks-write>
 
   capability sys_admin,