Add two profiles directory to have smaller dir.

apparmor.d/profiles-s-z/update-ca-certificates

@@ -0,0 +1,114 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2020-2021 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}{s,}bin/update-ca-certificates
+profile update-ca-certificates @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+  include <abstractions/ssl_certs>
+
+  @{exec_path} r,
+  /{usr/,}bin/{,ba,da}sh rix,
+
+  /{usr/,}bin/basename   rix,
+  /{usr/,}bin/cat        rix,
+  /{usr/,}bin/chmod      rix,
+  /{usr/,}bin/mktemp     rix,
+  /{usr/,}bin/mv         rix,
+  /{usr/,}bin/readlink   rix,
+  /{usr/,}bin/rm         rix,
+  /{usr/,}bin/sed        rix,
+  /{usr/,}bin/sort       rix,
+  /{usr/,}bin/wc         rix,
+  /{usr/,}bin/find       rix,
+  /{usr/,}bin/ln         rix,
+  /{usr/,}bin/test       rix,
+
+  /{usr/,}bin/openssl    rix,
+
+  /etc/ca-certificates/update.d/             r,
+  /etc/ca-certificates/update.d/jks-keystore rCx -> jks-keystore,
+  /{usr/,}bin/run-parts                      rCx -> run-parts,
+
+  /etc/ r,
+  /etc/ca-certificates.conf r,
+  /etc/ssl/certs/ca-certificates.crt rw,
+  /etc/ssl/certs/*.pem rw,
+  /etc/ssl/certs/[0-9a-f]*.[0-9] rw,
+
+  /{usr/,}lib/locale/locale-archive r,
+
+        /tmp/ r,
+  owner /tmp/ca-certificates{,.crt}.tmp.* rw,
+
+  # For shell pwd
+  /root/ r,
+
+  /usr/local/share/ r,
+
+  @{PROC}/filesystems r,
+
+
+  profile run-parts {
+    include <abstractions/base>
+
+    /{usr/,}bin/run-parts mr,
+
+    /etc/ca-certificates/update.d/ r,
+
+    # file_inherit
+    owner /dev/pts/[0-9]* rw,
+
+  }
+
+  profile jks-keystore {
+    include <abstractions/base>
+    include <abstractions/consoles>
+    include <abstractions/nameservice-strict>
+    include <abstractions/ssl_certs>
+
+    /etc/ca-certificates/update.d/jks-keystore mr,
+
+    /{usr/,}lib/ r,
+    /{usr/,}lib/jvm/java-[0-9]*-openjdk-*/jre/bin/java rix,
+    /{usr/,}lib/jvm/java-[0-9]*-openjdk-*/bin/java     rix,
+    /{usr/,}lib/jvm/java-[0-9]*-openjdk-*/lib/server/classes.jsa mr,
+
+    /{usr/,}bin/{,ba,da}sh rix,
+    /{usr/,}bin/sed        rix,
+    /{usr/,}bin/head       rix,
+    /{usr/,}bin/mountpoint rix,
+    # Do not strip env to avoid errors like the following:
+    #  ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open
+    #  shared object file): ignored.
+    /{usr/,}bin/dpkg-query rpx,
+    #
+    /{usr/,}bin/dpkg       rPx -> child-dpkg,
+
+    /usr/share/ca-certificates-java/ca-certificates-java.jar r,
+    /usr/share/java/java-atk-wrapper.jar r,
+
+    /etc/default/cacerts r,
+    /etc/ssl/certs/java/cacerts rw,
+
+    /etc/java-[0-9]*-openjdk/{,**} r,
+
+    owner @{PROC}/@{pid}/coredump_filter rw,
+    owner @{PROC}/@{pid}/coredump rw,
+    owner @{PROC}/@{pid}/cgroup r,
+    owner @{PROC}/@{pid}/mountinfo r,
+
+    @{sys}/fs/cgroup/** r,
+
+    owner /tmp/hsperfdata_*/ rw,
+    owner /tmp/hsperfdata_*/@{pid} rw,
+
+  }
+
+  include if exists <local/update-ca-certificates>
+}