Merge Add gpg-agent profile

Signed-off-by: Paulo Flabiano Smorigo <pfsmorigo@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1528
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Paulo Flabiano Smorigo <pfsmorigo@gmail.com>

profiles/apparmor.d/gpg-agent

@@ -0,0 +1,53 @@
+#------------------------------------------------------------------
+#    Copyright (C) 2025 Canonical Ltd.
+#
+#    Author: Paulo Flabiano Smorigo <pfsmorigo@canonical.com>
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#------------------------------------------------------------------
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{GNUPG_DEFAULT}="@{HOME}/{.,.config/}gnupg"
+@{GNUPG_PACMAN}="{/etc/pacman.d/,/var/lib/*/{.,}}gnupg"
+@{GNUPG_ZYPPER}="/var/tmp/zypp.*"
+@{GNUPG_CONFIGS}="{@{GNUPG_DEFAULT},@{GNUPG_PACMAN},@{GNUPG_ZYPPER}}"
+
+profile gpg-agent /usr/bin/gpg-agent {
+  include <abstractions/base>
+  include <abstractions/consoles>
+
+  capability dac_read_search,
+
+  @{etc_ro}/gnupg/*.conf r,
+  /usr/share/{,doc/}gnupg/{,**} r,
+  /usr/lib/gnupg/{,**} r,
+
+  /usr/bin/gpg-agent mr,
+  /usr/bin/pinentry-* rPix,
+  /usr/bin/scdaemon rPix,
+  /usr/lib/{,gnupg/}scdaemon rPix,
+
+  @{PROC}/@{pid}/fd/ r,
+
+  owner @{run}/user/@{uid}/gnupg/{*.conf,sshcontrol} r,
+  owner @{run}/user/@{uid}/gnupg/{,d.**/} rw,
+  owner @{run}/user/@{uid}/gnupg/{,d.**/}S.gpg-agent{,.browser,.extra,.ssh} rw,
+  owner @{run}/user/@{uid}/gnupg/{,d.**/}S.{dirmngr,keyboxd} rw,
+  owner @{run}/user/@{uid}/gnupg/private-keys-v1.d/{,**.key{,.tmp}} rw,
+
+  owner @{GNUPG_CONFIGS}/{,**} rw,
+  owner @{GNUPG_CONFIGS}/{*.conf,sshcontrol} r,
+  owner @{GNUPG_CONFIGS}/{,private-keys-v1.d/{,**.key{,.tmp}}} rw,
+  owner @{GNUPG_CONFIGS}/{,d.**/}S.gpg-agent{,.ssh,.browser,.extra} rw,
+
+  owner /dev/tty[0-9]* rw,
+
+  include if exists <local/gpg-agent>
+}
+
+# vim: ft=apparmor

profiles/apparmor.d/unix-chkpwd

@@ -30,6 +30,9 @@ profile unix-chkpwd /{,usr/}{,s}bin/unix_chkpwd {
   /run/host/userdb/*.user r,
   /run/host/userdb/*.user-privileged r,
 
+  # authd socket for PAM
+  @{run}/authd.sock rw,
+
   # file_inherit
   owner /dev/tty[0-9]* rw,