feat(profile): add profile for most of udev internat scripts

Required by FSP.

apparmor.d/groups/systemd/systemd-udevd

@@ -8,7 +8,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{exec_path} = @{bin}/udevadm @{lib}/systemd/systemd-udevd
-profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
+profile systemd-udevd @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/common/systemd>
   include <abstractions/consoles>

apparmor.d/profiles-s-z/udev-ata_id

@@ -0,0 +1,23 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/udev/ata_id
+profile udev-ata_id @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/disks-read>
+
+  capability sys_rawio,
+
+  @{exec_path} mr,
+
+  /etc/udev/udev.conf r,
+
+  include if exists <local/udev-ata_id>
+}
+
+# vim:syntax=apparmor

apparmor.d/profiles-s-z/udev-bcache-export-cached

@@ -0,0 +1,23 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/udev/bcache-export-cached
+profile udev-bcache-export-cached @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/disks-read>
+
+  @{exec_path} mr,
+
+  @{sh_path}                rix,
+  @{bin}/{m,g,}awk          rix,
+  @{bin}/bcache-super-show  rix,
+
+  include if exists <local/udev-bcache-export-cached>
+}
+
+# vim:syntax=apparmor

apparmor.d/profiles-s-z/udev-cdrom_id

@@ -0,0 +1,24 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/udev/cdrom_id
+profile udev-cdrom_id @{exec_path} {
+  include <abstractions/base>
+
+  capability sys_rawio,
+
+  @{exec_path} mr,
+
+  /etc/udev/udev.conf r,
+
+  /dev/sr@{int} r,
+
+  include if exists <local/udev-cdrom_id>
+}
+
+# vim:syntax=apparmor

apparmor.d/profiles-s-z/udev-fido_id

@@ -0,0 +1,24 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/udev/fido_id
+profile udev-fido_id @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/devices-usb-read>
+
+  @{exec_path} mr,
+
+  /etc/udev/udev.conf r,
+
+  @{sys}/devices/@{pci}/report_descriptor r,
+  @{sys}/devices/virtual/**/report_descriptor r,
+
+  include if exists <local/udev-fido_id>
+}
+
+# vim:syntax=apparmor

apparmor.d/profiles-s-z/udev-hdparm

@@ -0,0 +1,28 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/udev/hdparm
+profile udev-hdparm @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  @{sh_path}         rix,
+  @{bin}/{,e}grep    rix,
+  @{bin}/sed         rix,
+  @{bin}/udevadm     rPx,
+
+  /etc/hdparm.conf r,
+
+  @{PROC}/cmdline r,
+  @{PROC}/mdstat r,
+
+  include if exists <local/udev-hdparm>
+}
+
+# vim:syntax=apparmor

apparmor.d/profiles-s-z/udev-probe-bcache

@@ -0,0 +1,21 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/udev/probe-bcache
+profile udev-probe-bcache @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/disks-read>
+
+  capability sys_rawio,
+
+  @{exec_path} mr,
+
+  include if exists <local/udev-probe-bcache>
+}
+
+# vim:syntax=apparmor

dists/flags/main.flags

@@ -352,7 +352,13 @@ telegram-desktop complain
 totem attach_disconnected,complain
 tracker-writeback complain
 ucf complain
+udev-ata_id complain
+udev-bcache-export-cached complain
+udev-cdrom_id complain
 udev-dmi-memory-id complain
+udev-fido_id complain
+udev-hdparm complain
+udev-probe-bcache complain
 udisksctl complain
 udisksd attach_disconnected,complain
 ufw complain