feat(profiles): improve ubuntu compatibility.

apparmor.d/groups/ubuntu/apt-esm-hook

@@ -10,6 +10,7 @@ include <tunables/global>
 profile apt-esm-hook @{exec_path} {
   include <abstractions/base>
   include <abstractions/apt-common>
+  include <abstractions/consoles>
 
   @{exec_path} mr,
 
@@ -17,6 +18,7 @@ profile apt-esm-hook @{exec_path} {
 
   /etc/machine-id r,
 
+  /var/cache/apt/pkgcache.bin.* rw,
   /var/lib/ubuntu-advantage/messages/{,**} rw,
 
   owner @{PROC}/@{pid}/fd/ r,

apparmor.d/groups/ubuntu/check-new-release-gtk

@@ -12,6 +12,7 @@ profile check-new-release-gtk @{exec_path} {
   include <abstractions/apt-common>
   include <abstractions/dbus-session-strict>
   include <abstractions/dconf-write>
+  include <abstractions/gtk>
   include <abstractions/nameservice-strict>
   include <abstractions/openssl>
   include <abstractions/python>
@@ -39,6 +40,8 @@ profile check-new-release-gtk @{exec_path} {
 
   /etc/update-manager/{,**} r,
 
+  /var/lib/update-manager/{,**} rw,
+
   owner @{user_cache_dirs}/update-manager-core/{,**} rw,
 
   owner @{run}/user/@{uid}/wayland-[0-9] rw,

apparmor.d/groups/ubuntu/list-oem-metapackages

@@ -18,9 +18,14 @@ profile list-oem-metapackages @{exec_path} {
   /{usr/,}bin/dpkg                                    rPx,
   /{usr/,}bin/ischroot                                rix,
 
+  /etc/machine-id r,
+
+  @{sys}/devices/ r,
   @{sys}/devices/**/ r,
+  @{sys}/devices/**/modalias r,
 
   owner @{PROC}/@{pid}/fd/ r,
+        @{PROC}/@{pids}/mountinfo r,
         @{PROC}/filesystems r,
 
   include if exists <local/list-oem-metapackages>

apparmor.d/groups/ubuntu/livepatch-notification

@@ -22,5 +22,7 @@ profile livepatch-notification @{exec_path} {
   owner @{run}/user/@{uid}/bus rw,
   owner @{run}/user/@{uid}/wayland-[0-9]* rw,
 
+  @{run}/user/@{uid}/gdm/Xauthority r,
+
   include if exists <local/livepatch-notification>
 }

apparmor.d/groups/ubuntu/update-motd-updates-available

@@ -43,6 +43,8 @@ profile update-motd-updates-available @{exec_path} {
   /var/cache/apt/ r,
   /var/cache/apt/** rwk,
 
+  /tmp/ r,
+
   owner @{PROC}/@{pid}/fd/ r,
         @{PROC}/@{pids}/mountinfo r,
 

apparmor.d/groups/ubuntu/update-notifier

@@ -10,8 +10,10 @@ include <tunables/global>
 profile update-notifier @{exec_path} {
   include <abstractions/base>
   include <abstractions/apt-common>
+  include <abstractions/audio>
   include <abstractions/dconf-write>
   include <abstractions/fonts>
+  include <abstractions/gtk>
   include <abstractions/nameservice-strict>
   include <abstractions/openssl>
   include <abstractions/python>