Initial support for zsys

apparmor.d/groups/apt/apt

@@ -88,6 +88,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
   /{usr/,}bin/snap                           rPUx,
   /{usr/,}lib/cnf-update-db                   rPx,
   /{usr/,}lib/needrestart/apt-pinvoke         rPx,
+  @{libexec}/zsys-system-autosnapshot         rPx,
 
   # For building the source after the download process is finished (apt-get source --compile)
   /{usr/,}bin/dpkg-buildpackage               rPUx,

apparmor.d/groups/apt/apt-listbugs-aptcleanup

@@ -6,7 +6,7 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-@{exec_path} = /usr/libexec/apt-listbugs/aptcleanup
+@{exec_path} = @{libexec}/apt-listbugs/aptcleanup
 profile apt-listbugs-aptcleanup @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>

apparmor.d/groups/apt/apt-listbugs-migratepins

@@ -6,7 +6,7 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-@{exec_path} = /usr/libexec/apt-listbugs/migratepins
+@{exec_path} = @{libexec}/apt-listbugs/migratepins
 profile apt-listbugs-migratepins @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>

apparmor.d/groups/apt/unattended-upgrade

@@ -49,7 +49,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
 
   dbus receive bus=system path=/org/freedesktop/NetworkManager
        interface=org.freedesktop.NetworkManager
-       member=StateChanged,
+       member={CheckPermissions,StateChanged},
 
   @{exec_path} mr,
 
@@ -74,11 +74,14 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
   /{usr/,}lib/apt/methods/http{,s}     rPx,
   /{usr/,}lib/needrestart/apt-pinvoke  rPx,
   /{usr/,}lib/update-notifier/update-motd-updates-available rPx,
+  @{libexec}/zsys-system-autosnapshot  rPx,
 
   /usr/share/distro-info/* r,
 
   /etc/apt/*.list r,
   /etc/apt/apt.conf.d/{,**} r,
+  /etc/update-manager/{,**} r,
+  /etc/update-motd.d/{91-release-upgrade,92-unattended-upgrades} r,
 
   /etc/machine-id r,