Prepare for AppArmor 3.1.3 release

- update version file - update library version Signed-off-by: John Johansen <john.johansen@canonical.com>
Merge [3.x] Update samba profiles
2025-09-03 15:55:46 +00:00 · 2023-02-27 17:24:32 -08:00 · 2023-02-27 19:52:17 +00:00 · 2023-02-27 20:37:38 +01:00 · 2023-02-27 20:36:30 +01:00 · 2023-02-26 13:57:12 -08:00
163 changed files with 939 additions and 276 deletions
--- a/binutils/aa_status.c
+++ b/binutils/aa_status.c
@@ -534,16 +534,19 @@ static int detailed_output(FILE *json) {
 				} else {
 					fprintf(json, "%s\"%s\": [{\"profile\": \"%s\", \"pid\": \"%s\", \"status\": \"%s\"}",
 					       // first element will be a unique executable
-					       i == 0 && j == 0 ? "" : "], ",
+					       j == 0 ? "" : "], ",
 					       filtered[j].exe, filtered[j].profile, filtered[j].pid, filtered[j].mode);
 				}

 			}
+			if (j > 0) {
+				fprintf(json, "]");
+			}
 		}
 		free_processes(filtered, nfiltered);
 	}
 	if (json) {
-		fprintf(json, "%s}}\n", nprocesses > 0 ? "]" : "");
+		fprintf(json, "}}\n");
 	}

 exit:
--- a/common/Version
+++ b/common/Version
@@ -1 +1 @@
-3.1.1
+3.1.3
--- a/libraries/libapparmor/include/aalogparse.h
+++ b/libraries/libapparmor/include/aalogparse.h
@@ -159,6 +159,8 @@ typedef struct
 	char *fs_type;
 	char *flags;
 	char *src_name;
+
+	char *class;
 } aa_log_record;

 /**
--- a/libraries/libapparmor/src/Makefile.am
+++ b/libraries/libapparmor/src/Makefile.am
@@ -30,9 +30,12 @@ INCLUDES = $(all_includes)
 # For more information, see:
 # http://www.gnu.org/software/libtool/manual/html_node/Libtool-versioning.html
 #
+# After changing the AA_LIB_* variables, also update EXPECTED_SO_NAME.
+
 AA_LIB_CURRENT = 13
-AA_LIB_REVISION = 0
+AA_LIB_REVISION = 2
 AA_LIB_AGE = 12
+EXPECTED_SO_NAME = libapparmor.so.1.12.2

 SUFFIXES = .pc.in .pc

@@ -81,4 +84,8 @@ tst_kernel_LDFLAGS = -pthread
 check_PROGRAMS = tst_aalogmisc tst_features tst_kernel
 TESTS = $(check_PROGRAMS)

+.PHONY: check-local
+check-local:
+	test -f ./.libs/$(EXPECTED_SO_NAME) || { echo '*** unexpected .so name/number for libapparmor (expected $(EXPECTED_SO_NAME), the actual filename is shown below) ***' ; ls -l ./.libs/libapparmor.so.*.* ; exit 1; }
+
 EXTRA_DIST = grammar.y scanner.l libapparmor.map libapparmor.pc
--- a/libraries/libapparmor/src/grammar.y
+++ b/libraries/libapparmor/src/grammar.y
@@ -159,7 +159,9 @@ aa_record_event_type lookup_aa_event(unsigned int type)
 %token TOK_KEY_NAMESPACE
 %token TOK_KEY_ERROR
 %token TOK_KEY_FSUID
+%token TOK_KEY_FSUID_UPPER
 %token TOK_KEY_OUID
+%token TOK_KEY_OUID_UPPER
 %token TOK_KEY_UID
 %token TOK_KEY_AUID
 %token TOK_KEY_SAUID
@@ -185,6 +187,7 @@ aa_record_event_type lookup_aa_event(unsigned int type)
 %token TOK_KEY_FSTYPE
 %token TOK_KEY_FLAGS
 %token TOK_KEY_SRCNAME
+%token TOK_KEY_CLASS

 %token TOK_SOCKLOGD_KERNEL
 %token TOK_SYSLOG_KERNEL
@@ -351,6 +354,10 @@ key: TOK_KEY_OPERATION TOK_EQUALS TOK_QUOTED_STRING
 	{ ret_record->fsuid = $3;}
 	| TOK_KEY_OUID TOK_EQUALS TOK_DIGITS
 	{ ret_record->ouid = $3;}
+	| TOK_KEY_FSUID_UPPER TOK_EQUALS TOK_QUOTED_STRING
+	{ free($3);} /* Ignore - fsuid username */
+	| TOK_KEY_OUID_UPPER TOK_EQUALS TOK_QUOTED_STRING
+	{ free($3);} /* Ignore - ouid username */
 	| TOK_KEY_SAUID TOK_EQUALS TOK_DIGITS
 	{ /* Ignore - Source audit ID from user AVC messages */ }
 	| TOK_KEY_HOSTNAME TOK_EQUALS safe_string
@@ -425,6 +432,8 @@ key: TOK_KEY_OPERATION TOK_EQUALS TOK_QUOTED_STRING
 		ret_record->event = AA_RECORD_INVALID;
 		ret_record->info = $1;
 	}
+	| TOK_KEY_CLASS TOK_EQUALS TOK_QUOTED_STRING
+	{ ret_record->class = $3; }
 	;

 apparmor_event:
--- a/libraries/libapparmor/src/libaalogparse.c
+++ b/libraries/libapparmor/src/libaalogparse.c
@@ -103,6 +103,8 @@ void free_record(aa_log_record *record)
 			free(record->flags);
 		if (record->src_name != NULL)
 			free(record->src_name);
+		if (record->class != NULL)
+			free(record->class);

 		free(record);
 	}
--- a/libraries/libapparmor/src/scanner.l
+++ b/libraries/libapparmor/src/scanner.l
@@ -72,7 +72,7 @@ void string_buf_append(unsigned int length, char *text)

 %}

-ws		[ \t\r\n]
+ws		[ \t\r\n\x1d]

 equals		"="
 digit		[[:digit:]]
@@ -121,6 +121,8 @@ key_namespace		"namespace"
 key_mask		"mask"
 key_denied_mask		"denied_mask"
 key_requested_mask	"requested_mask"
+key_denied		"denied"
+key_requested		"requested"
 key_attribute		"attribute"
 key_task		"task"
 key_parent		"parent"
@@ -138,7 +140,9 @@ key_sock_type		"sock_type"
 key_protocol		"protocol"
 key_error		"error"
 key_fsuid		"fsuid"
+key_fsuid_upper		"FSUID"
 key_ouid		"ouid"
+key_ouid_upper		"OUID"
 key_uid			"uid"
 key_auid		"auid"
 key_sauid		"sauid"
@@ -161,11 +165,13 @@ key_dest		"dest"
 key_path		"path"
 key_interface		"interface"
 key_member		"member"
+key_method		"method"
 key_signal		"signal"
 key_peer		"peer"
 key_fstype		"fstype"
 key_flags		"flags"
 key_srcname		"srcname"
+key_class		"class"
 audit			"audit"

 /* network addrs */
@@ -307,6 +313,8 @@ yy_flex_debug = 0;
 {key_mask}		{ return(TOK_KEY_MASK); }
 {key_denied_mask}	{ return(TOK_KEY_DENIED_MASK); }
 {key_requested_mask}	{ return(TOK_KEY_REQUESTED_MASK); }
+{key_denied}		{ return(TOK_KEY_DENIED_MASK); }
+{key_requested}		{ return(TOK_KEY_REQUESTED_MASK); }
 {key_attribute}		{ BEGIN(sub_id); return(TOK_KEY_ATTRIBUTE); }
 {key_task}		{ return(TOK_KEY_TASK); }
 {key_parent}		{ return(TOK_KEY_PARENT); }
@@ -324,7 +332,9 @@ yy_flex_debug = 0;
 {key_protocol}		{ return(TOK_KEY_PROTOCOL); }
 {key_error}		{ return(TOK_KEY_ERROR); }
 {key_fsuid}		{ return(TOK_KEY_FSUID); }
+{key_fsuid_upper}	{ return(TOK_KEY_FSUID_UPPER); }
 {key_ouid}		{ return(TOK_KEY_OUID); }
+{key_ouid_upper}	{ return(TOK_KEY_OUID_UPPER); }
 {key_uid}		{ return(TOK_KEY_UID); }
 {key_auid}		{ return(TOK_KEY_AUID); }
 {key_sauid}		{ return(TOK_KEY_SAUID); }
@@ -346,11 +356,13 @@ yy_flex_debug = 0;
 {key_path}		{ return(TOK_KEY_PATH); }
 {key_interface}		{ return(TOK_KEY_INTERFACE); }
 {key_member}		{ return(TOK_KEY_MEMBER); }
+{key_method}		{ return(TOK_KEY_MEMBER); }
 {key_signal}		{ BEGIN(sub_id); return(TOK_KEY_SIGNAL); }
 {key_peer}		{ BEGIN(safe_string); return(TOK_KEY_PEER); }
 {key_fstype}		{ return(TOK_KEY_FSTYPE); }
 {key_flags}		{ BEGIN(safe_string); return(TOK_KEY_FLAGS); }
 {key_srcname}		{ BEGIN(safe_string); return(TOK_KEY_SRCNAME); }
+{key_class}		{ BEGIN(safe_string); return(TOK_KEY_CLASS); }

 {socklogd_kernel}	{ BEGIN(dmesg_timestamp); return(TOK_SOCKLOGD_KERNEL); }
 {syslog_kernel}		{ BEGIN(dmesg_timestamp); return(TOK_SYSLOG_KERNEL); }
--- a/libraries/libapparmor/swig/python/test/test_python.py.in
+++ b/libraries/libapparmor/swig/python/test/test_python.py.in
@@ -35,6 +35,7 @@ OUTPUT_MAP = {
    'Local port':       'net_local_port',
    'Foreign port':     'net_foreign_port',
    'Audit subid':      'audit_sub_id',
+    'Class':            '_class',
 }

 # FIXME: pull this automatically out of LibAppArmor, but swig
@@ -109,7 +110,7 @@ class AAPythonBindingsTests(unittest.TestCase):
        """parse the swig created record and construct a dict from it"""

        new_record = dict()
-        for key in [x for x in dir(record) if not (x.startswith('_') or x == 'this')]:
+        for key in [x for x in dir(record) if not (x.startswith('__') or x == 'this')]:
            value = getattr(record, key)
            if key == "event" and value in EVENT_MAP:
                new_record[key] = EVENT_MAP[value]
--- a/libraries/libapparmor/testsuite/test_multi.c
+++ b/libraries/libapparmor/testsuite/test_multi.c
@@ -134,6 +134,8 @@ int print_results(aa_log_record *record)
 		print_string("Flags", record->flags);
 		print_string("Src name", record->src_name);

+		print_string("Class", record->class);
+
 		print_long("Epoch", record->epoch, 0);
 		print_long("Audit subid", (long) record->audit_sub_id, 0);
 	return(0);
--- a/libraries/libapparmor/testsuite/test_multi/0x1d-uppercase-FSUID-OUID.err
+++ b/libraries/libapparmor/testsuite/test_multi/0x1d-uppercase-FSUID-OUID.err
--- a/libraries/libapparmor/testsuite/test_multi/0x1d-uppercase-FSUID-OUID.in
+++ b/libraries/libapparmor/testsuite/test_multi/0x1d-uppercase-FSUID-OUID.in
@@ -0,0 +1 @@
+type=AVC msg=audit(1661734785.992:270): apparmor="ALLOWED" operation="open" profile="/usr/bin/dolphin" name="/home/otis/.config/kdedefaults/kdeglobals" pid=3483 comm="dolphin" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0FSUID="otis" OUID="root"
--- a/libraries/libapparmor/testsuite/test_multi/0x1d-uppercase-FSUID-OUID.out
+++ b/libraries/libapparmor/testsuite/test_multi/0x1d-uppercase-FSUID-OUID.out
@@ -0,0 +1,15 @@
+START
+File: 0x1d-uppercase-FSUID-OUID.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1661734785.992:270
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 0
+Profile: /usr/bin/dolphin
+Name: /home/otis/.config/kdedefaults/kdeglobals
+Command: dolphin
+PID: 3483
+Epoch: 1661734785
+Audit subid: 270
--- a/libraries/libapparmor/testsuite/test_multi/0x1d-uppercase-FSUID-OUID.profile
+++ b/libraries/libapparmor/testsuite/test_multi/0x1d-uppercase-FSUID-OUID.profile
@@ -0,0 +1,4 @@
+/usr/bin/dolphin {
+  /home/otis/.config/kdedefaults/kdeglobals r,
+
+}
--- a/libraries/libapparmor/testsuite/test_multi/testcase_dbus_11.err
+++ b/libraries/libapparmor/testsuite/test_multi/testcase_dbus_11.err
--- a/libraries/libapparmor/testsuite/test_multi/testcase_dbus_11.in
+++ b/libraries/libapparmor/testsuite/test_multi/testcase_dbus_11.in
@@ -0,0 +1 @@
+Dec 15 17:32:17 kinetic kernel: [4835959.046111] audit: type=1107 audit(1671125537.724:209): pid=7308 uid=0 auid=4294967295 ses=4294967295 msg='apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/freedesktop/DBus" interface="org.freedesktop.DBus" method="Hello" mask="send" label="/tmp/apparmor/tests/regression/apparmor/dbus_message" peer_label="unconfined" exe="/usr/local/bin/dbus-broker" sauid=0 hostname=? addr=? terminal=?'
--- a/libraries/libapparmor/testsuite/test_multi/testcase_dbus_11.out
+++ b/libraries/libapparmor/testsuite/test_multi/testcase_dbus_11.out
@@ -0,0 +1,15 @@
+START
+File: testcase_dbus_11.in
+Event type: AA_RECORD_DENIED
+Audit ID: 1671125537.724:209
+Operation: dbus_method_call
+Denied Mask: send
+Profile: /tmp/apparmor/tests/regression/apparmor/dbus_message
+Peer profile: unconfined
+Command: /usr/local/bin/dbus-broker
+DBus bus: session
+DBus path: /org/freedesktop/DBus
+DBus interface: org.freedesktop.DBus
+DBus member: Hello
+Epoch: 1671125537
+Audit subid: 209
--- a/libraries/libapparmor/testsuite/test_multi/testcase_dbus_11.profile
+++ b/libraries/libapparmor/testsuite/test_multi/testcase_dbus_11.profile
@@ -0,0 +1,4 @@
+/tmp/apparmor/tests/regression/apparmor/dbus_message {
+  dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=Hello peer=(label=unconfined),
+
+}
--- a/parser/Makefile
+++ b/parser/Makefile
@@ -386,11 +386,11 @@ DISTRO=$(shell if [ -f /etc/slackware-version ] ; then \
 	       elif [ -f /etc/debian_version ] ; then \
 	         echo debian ;\
 	       elif which rpm > /dev/null ; then \
-	         if [ "$(rpm --eval '0%{?suse_version}')" != "0" ] ; then \
+	         if [ "$$(rpm --eval '0%{?suse_version}')" != "0" ] ; then \
 	             echo suse ;\
-	         elif [ "$(rpm --eval '%{_host_vendor}')" = redhat ] ; then \
+	         elif [ "$$(rpm --eval '%{_host_vendor}')" = redhat ] ; then \
 	            echo rhel4 ;\
-	         elif [ "$(rpm --eval '0%{?fedora}')" != "0" ] ; then \
+	         elif [ "$$(rpm --eval '0%{?fedora}')" != "0" ] ; then \
 	            echo rhel4 ;\
 	         else \
 	            echo unknown ;\
--- a/parser/af_unix.cc
+++ b/parser/af_unix.cc
@@ -111,8 +111,7 @@ unix_rule::unix_rule(unsigned int type_p, bool audit_p, bool denied):

 unix_rule::unix_rule(int mode_p, struct cond_entry *conds,
 		     struct cond_entry *peer_conds):
-	af_rule("unix"), addr(NULL), peer_addr(NULL),
-	audit(0), deny(0)
+	af_rule("unix"), addr(NULL), peer_addr(NULL)
 {
 	move_conditionals(conds);
 	move_peer_conditionals(peer_conds);
@@ -136,7 +135,7 @@ ostream &unix_rule::dump_local(ostream &os)
 {
 	af_rule::dump_local(os);
 	if (addr)
-		os << "addr='" << addr << "'";
+		os << " addr='" << addr << "'";
 	return os;
 }

@@ -144,7 +143,7 @@ ostream &unix_rule::dump_peer(ostream &os)
 {
 	af_rule::dump_peer(os);
 	if (peer_addr)
-		os << "addr='" << peer_addr << "'";
+		os << " addr='" << peer_addr << "'";
 	return os;
 }

--- a/parser/af_unix.h
+++ b/parser/af_unix.h
@@ -36,9 +36,6 @@ class unix_rule: public af_rule {
 public:
 	char *addr;
 	char *peer_addr;
-	int mode;
-	int audit;
-	bool deny;

 	unix_rule(unsigned int type_p, bool audit_p, bool denied);
 	unix_rule(int mode, struct cond_entry *conds,
--- a/parser/libapparmor_re/chfa.cc
+++ b/parser/libapparmor_re/chfa.cc
@@ -193,9 +193,8 @@ void CHFA::insert_state(vector<pair<size_t, size_t> > &free_list,
 	State *default_state = dfa.nonmatching;
 	ssize_t base = 0;
 	int resize;
-
 	StateTrans &trans = from->trans;
-	ssize_t c = trans.begin()->first.c;
+	ssize_t c;
 	ssize_t prev = 0;
 	ssize_t x = first_free;

@@ -204,6 +203,7 @@ void CHFA::insert_state(vector<pair<size_t, size_t> > &free_list,
 	if (trans.empty())
 		goto do_insert;

+	c = trans.begin()->first.c;
 repeat:
 	resize = 0;
 	/* get the first free entry that won't underflow */
@@ -251,10 +251,18 @@ repeat:
 			first_free = next;
 	}

-do_insert:
+	/* these flags will only be set on states that have transitions */
 	if (c < 0) {
 		base |= MATCH_FLAG_OOB_TRANSITION;
 	}
+do_insert:
+	/* While a state without transitions could have the diff encode
+	 * flag set, it would be pointless resulting in just an extra
+	 * state transition in the encoding chain, and so it should be
+	 * considered an error
+	 * TODO: add check that state without transitions isn't being
+	 * given a diffencode flag
+	 */
 	if (from->flags & DiffEncodeFlag)
 		base |= DiffEncodeBit32;
 	default_base.push_back(make_pair(default_state, base));
--- a/parser/tst/gen-xtrans.py
+++ b/parser/tst/gen-xtrans.py
@@ -27,7 +27,7 @@ trans_modifiers = {

 targets = ("", "target", "target2")
 # null_target uses "_" instead of "" because "" gets skipped in some for loops. Replace with "" when actually using the value.
-null_target = ("_")
+null_target = ("_",)

 named_trans = {
    "p": targets,
--- a/profiles/apparmor.d/abstractions/audio
+++ b/profiles/apparmor.d/abstractions/audio
@@ -85,5 +85,8 @@ owner @{HOME}/.local/share/openal/hrtf/{,**} r,
 # wildmidi
 /etc/wildmidi/wildmidi.cfg r,

+# pipewire
+/usr/share/pipewire/client.conf r,
+
  # Include additions to the abstraction
  include if exists <abstractions/audio.d>
--- a/profiles/apparmor.d/abstractions/base
+++ b/profiles/apparmor.d/abstractions/base
@@ -101,6 +101,7 @@
  @{PROC}/cpuinfo                r,
  @{sys}/devices/system/cpu/       r,
  @{sys}/devices/system/cpu/online r,
+  @{sys}/devices/system/cpu/possible r,

  # glibc's *printf protections read the maps file
  @{PROC}/@{pid}/{maps,auxv,status} r,
--- a/profiles/apparmor.d/abstractions/crypto
+++ b/profiles/apparmor.d/abstractions/crypto
@@ -13,6 +13,7 @@

  abi <abi/3.0>,

+  @{etc_ro}/gcrypt/hwf.deny r,
  @{etc_ro}/gcrypt/random.conf r,
  @{PROC}/sys/crypto/fips_enabled r,

--- a/profiles/apparmor.d/abstractions/groff
+++ b/profiles/apparmor.d/abstractions/groff
@@ -0,0 +1,67 @@
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2002-2009 Novell/SUSE
+#    Copyright (C) 2009 Canonical Ltd.
+#    Copyright (C) 2023 SUSE LLC
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+  # Note: executing groff and nroff themself is not included in this abstraction
+  # so that you can choose to ix, Px or Cx them in your profile
+
+  # groff/nroff helpers, preprocessors, and postprocessors
+  /usr/bin/addftinfo mrix,
+  /usr/bin/afmtodit mrix,
+  /usr/bin/chem mrix,
+  /usr/bin/eqn mrix,
+  /usr/bin/eqn2graph mrix,
+  /usr/bin/gdiffmk mrix,
+  /usr/bin/geqn mrix,
+  /usr/bin/grap2graph mrix,
+  /usr/bin/grn mrix,
+  /usr/bin/grodvi mrix,
+  /usr/bin/groffer mrix,
+  /usr/bin/grog mrix,
+  /usr/bin/grolbp mrix,
+  /usr/bin/grolj4 mrix,
+  /usr/bin/gropdf mrix,
+  /usr/bin/grops mrix,
+  /usr/bin/grotty mrix,
+  /usr/bin/gtbl mrix,
+  /usr/bin/hpftodit mrix,
+  /usr/bin/indxbib mrix,
+  /usr/bin/lkbib mrix,
+  /usr/bin/lookbib mrix,
+  /usr/bin/mmroff mrix,
+  /usr/bin/neqn mrix,
+  /usr/bin/pdfmom mrix,
+  /usr/bin/pdfroff mrix,
+  /usr/bin/pfbtops mrix,
+  /usr/bin/pic mrix,
+  /usr/bin/pic2graph mrix,
+  /usr/bin/post-grohtml mrix,
+  /usr/bin/pre-grohtml mrix,
+  /usr/bin/preconv mrix,
+  /usr/bin/refer mrix,
+  /usr/bin/roff2dvi mrix,
+  /usr/bin/roff2html mrix,
+  /usr/bin/roff2pdf mrix,
+  /usr/bin/roff2ps mrix,
+  /usr/bin/roff2text mrix,
+  /usr/bin/roff2x mrix,
+  /usr/bin/soelim mrix,
+  /usr/bin/tbl mrix,
+  /usr/bin/tfmtodit mrix,
+  /usr/bin/troff mrix,
+  /usr/bin/xtotroff mrix,
+
+  # at least its macros and fonts
+  /usr/libexec/groff/** r,
+  /usr/share/groff/** r,
+
+  # Include additions to the abstraction
+  include if exists <abstractions/groff.d>
--- a/profiles/apparmor.d/abstractions/kde
+++ b/profiles/apparmor.d/abstractions/kde
@@ -41,8 +41,11 @@ owner @{HOME}/.config/Trolltech.conf rwk,
 owner @{HOME}/.config/baloofilerc r, # indexing options (excludes, etc), used by KFileWidget
 owner @{HOME}/.config/dolphinrc r, # settings used by KFileWidget
 owner @{HOME}/.config/kde.org/libphonon.conf r, # for KNotifications::sendEvent()
+owner @{HOME}/.config/kdedefaults/kdeglobals r, # QPlatformThemeFactory::create() -> KDEPlasmaPlatformTheme.so
+owner @{HOME}/.config/kdedefaults/kwinrc r, # QStyleFactory::create() -> qt5/plugins/styles/breeze.so
 owner @{HOME}/.config/kdeglobals r, # global settings, used by Breeze style, etc.
 owner @{HOME}/.config/klanguageoverridesrc r, # per-application languages, for KDEPrivate::initializeLanguages() from libKF5XmlGui.so
+owner @{HOME}/.config/kwinrc r, # QStyleFactory::create() -> qt5/plugins/styles/breeze.so
 owner @{HOME}/.config/trashrc r, # Used by KFileWidget

 /usr/share/X11/XKeysymDB r,
--- a/profiles/apparmor.d/abstractions/nameservice
+++ b/profiles/apparmor.d/abstractions/nameservice
@@ -44,6 +44,7 @@
  @{run}/{resolvconf,NetworkManager,systemd/resolve,connman,netconfig}/resolv.conf r,
  @{etc_ro}/resolvconf/run/resolv.conf  r,
  @{run}/systemd/resolve/stub-resolv.conf r,
+  /mnt/wsl/resolv.conf r,

  @{etc_ro}/samba/lmhosts  r,
  @{etc_ro}/services       r,
--- a/profiles/apparmor.d/abstractions/nvidia
+++ b/profiles/apparmor.d/abstractions/nvidia
@@ -23,9 +23,13 @@

  @{sys}/devices/system/memory/block_size_bytes r,

+  owner @{HOME}/.cache/nvidia/ w,
+  owner @{HOME}/.cache/nvidia/GLCache/ rw,
+  owner @{HOME}/.cache/nvidia/GLCache/** rwk,
  owner @{HOME}/.nv/ w,
  owner @{HOME}/.nv/GLCache/ rw,
  owner @{HOME}/.nv/GLCache/** rwk,
+  owner @{PROC}/@{pid}/comm r, # somehwere in libnvidia-glcore.so

  unix (send, receive) type=dgram peer=(addr="@nvidia[0-9a-f]*"),

--- a/profiles/apparmor.d/abstractions/openssl
+++ b/profiles/apparmor.d/abstractions/openssl
@@ -11,6 +11,7 @@
  abi <abi/3.0>,

  /etc/ssl/openssl.cnf r,
+  /etc/ssl/openssl-*.cnf r,
  /etc/ssl/{engdef,engines}.d/ r,
  /etc/ssl/{engdef,engines}.d/*.cnf r,
  /usr/share/ssl/openssl.cnf r,
--- a/profiles/apparmor.d/abstractions/samba
+++ b/profiles/apparmor.d/abstractions/samba
@@ -25,9 +25,10 @@
  /var/log/samba/cores/** rw,
  /var/log/samba/* w,
  @{run}/{,lock/}samba/ w,
-  @{run}/{,lock/}samba/*.tdb rw,
-  @{run}/{,lock/}samba/msg.lock/ rwk,
-  @{run}/{,lock/}samba/msg.lock/[0-9]* rwk,
+  @{run}/{,lock/}samba/*.tdb rwk,
+  @{run}/{,lock/}samba/msg.{lock,sock}/ rwk,
+  @{run}/{,lock/}samba/msg.{lock,sock}/[0-9]* rwk,
+  /var/cache/samba/*.tdb rwk,
  /var/cache/samba/msg.lock/ rwk,
  /var/cache/samba/msg.lock/[0-9]* rwk,

--- a/profiles/apparmor.d/abstractions/ssl_certs
+++ b/profiles/apparmor.d/abstractions/ssl_certs
@@ -17,7 +17,7 @@
  /etc/{,libre}ssl/certs/{,**} r,
  /{etc,usr/share}/pki/bl[ao]cklist/{,*} r,
  /{etc,usr/share}/pki/trust/{,*} r,
-  /{etc,usr/share}/pki/trust/anchors/{,**} r,
+  /{etc,usr/share}/pki/trust/{bl[oa]cklist,anchors}/{,**} r,
  /usr/share/ca-certificates/{,**} r,
  /usr/share/ssl/certs/ca-bundle.crt          r,
  /usr/local/share/ca-certificates/{,**} r,
--- a/profiles/apparmor.d/abstractions/ubuntu-helpers
+++ b/profiles/apparmor.d/abstractions/ubuntu-helpers
@@ -80,6 +80,7 @@ profile sanitized_helper {
  /opt/brave.com/brave{,-beta,-dev,-nightly}/chrome-sandbox PUxr,
  /opt/brave.com/brave{,-beta,-dev,-nightly}/brave-browser{,-beta,-dev,-nightly} Pixr,
  /opt/brave.com/brave{,-beta,-dev,-nightly}/brave Pixr,
+  /opt/brave.com/brave{,-beta,-dev,-nightly}/chrome_crashpad_handler Pixr,
  /opt/brave.com/brave{,-beta,-dev,-nightly}/{,**/}lib*.so{,.*} m,

  # Full access
--- a/profiles/apparmor.d/lsb_release
+++ b/profiles/apparmor.d/lsb_release
@@ -30,6 +30,8 @@ profile lsb_release {
  /{usr/,}bin/dash ixr,
  /usr/bin/basename ixr,
  /usr/bin/dpkg-query ixr,
+  /usr/bin/cat ixr,
+  /usr/bin/cut ixr,
  /usr/bin/getopt ixr,
  /usr/bin/sed ixr,
  /usr/bin/tr ixr,
--- a/profiles/apparmor.d/nvidia_modprobe
+++ b/profiles/apparmor.d/nvidia_modprobe
@@ -54,10 +54,10 @@ profile nvidia_modprobe {
    # System files

    /etc/modprobe.d/{,*.conf} r,
-    /etc/nvidia/current/*.conf r,
+    /etc/nvidia/{current,legacy*,tesla*}/*.conf r,
    @{sys}/module/ipmi_devintf/initstate r,
    @{sys}/module/ipmi_msghandler/initstate r,
-    @{sys}/module/nvidia/initstate r,
+    @{sys}/module/{drm,nvidia}/initstate r,
    @{PROC}/cmdline r,
  }

--- a/profiles/apparmor.d/samba-bgqd
+++ b/profiles/apparmor.d/samba-bgqd
@@ -14,9 +14,10 @@ profile samba-bgqd /usr/lib*/samba/{,samba/}samba-bgqd {
  @{PROC}/sys/kernel/core_pattern r,
  owner @{PROC}/@{pid}/fd/ r,

-  @{run}/samba/samba-bgqd.pid wk,
+  @{run}/{,samba/}samba-bgqd.pid rwk,

-  /usr/lib*/samba/{,samba/}samba-bgqd m,
+  /usr/lib*/samba/{,samba/}samba-bgqd mr,
+  /var/cache/samba/printing/*.tdb rwk,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/samba-bgqd>
--- a/profiles/apparmor.d/samba-dcerpcd
+++ b/profiles/apparmor.d/samba-dcerpcd
@@ -16,10 +16,11 @@ include <tunables/global>
 profile samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {
  include <abstractions/samba-rpcd>

-  @{run}/samba/samba-dcerpcd.pid wk,
+  @{run}/{,samba/}samba-dcerpcd.pid rwk,

-  /usr/lib*/samba/{,samba/}samba-dcerpcd m,
+  /usr/lib*/samba/{,samba/}samba-dcerpcd mr,

+  /usr/lib*/samba/ r,
  /usr/lib*/samba/{,samba/}rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} Px -> samba-rpcd,
  /usr/lib*/samba/{,samba/}rpcd_classic Px -> samba-rpcd-classic,
  /usr/lib*/samba/{,samba/}rpcd_spoolss Px -> samba-rpcd-spoolss,
--- a/profiles/apparmor.d/samba-rpcd
+++ b/profiles/apparmor.d/samba-rpcd
@@ -15,7 +15,10 @@ include <tunables/global>

 profile samba-rpcd /usr/lib*/samba/{,samba/}rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} {
  include <abstractions/samba-rpcd>
-  /usr/lib*/samba/{,samba/}rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} m,
+  /usr/lib*/samba/{,samba/}rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} mr,
+
+  @{run}/samba/ncalrpc/np/winreg wr,
+
  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/samba-rpcd>
 }
--- a/profiles/apparmor.d/samba-rpcd-classic
+++ b/profiles/apparmor.d/samba-rpcd-classic
@@ -17,7 +17,7 @@ profile samba-rpcd-classic /usr/lib*/samba/{,samba/}rpcd_classic {
  include <abstractions/samba-rpcd>
  include <abstractions/wutmp>

-  /usr/lib*/samba/{,samba/}rpcd_classic m,
+  /usr/lib*/samba/{,samba/}rpcd_classic mr,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/samba-rpcd-classic>
--- a/profiles/apparmor.d/samba-rpcd-spoolss
+++ b/profiles/apparmor.d/samba-rpcd-spoolss
@@ -16,8 +16,16 @@ include <tunables/global>
 profile samba-rpcd-spoolss /usr/lib*/samba/{,samba/}rpcd_spoolss {
  include <abstractions/samba-rpcd>

-  /usr/lib*/samba/{,samba/}rpcd_spoolss m,
+  /usr/lib*/samba/{,samba/}rpcd_spoolss mr,
  /usr/lib*/samba/{,samba/}samba-bgqd Px -> samba-bgqd,
+  /var/cache/samba/printing/ w,
+  /var/cache/samba/printing/*.tdb rwk,
+  @{run}/{,samba/}samba-bgqd.pid rk,
+
+  /dev/urandom rw,
+
+  @{run}/samba/ncalrpc/ rw,
+  @{run}/samba/ncalrpc/** rw,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/samba-rpcd-spoolss>
--- a/profiles/apparmor.d/sbin.syslog-ng
+++ b/profiles/apparmor.d/sbin.syslog-ng
@@ -61,6 +61,7 @@ profile syslog-ng /{usr/,}{bin,sbin}/syslog-ng {
  /{var,var/run,run}/log/journal/ r,
  /{var,var/run,run}/log/journal/*/ r,
  /{var,var/run,run}/log/journal/*/*.journal r,
+  /{var,var/run,run}/log/journal/*.journal r,
  @{run}/syslog-ng.ctl a,
  @{run}/syslog-ng/additional-log-sockets.conf r,

--- a/profiles/apparmor.d/usr.sbin.avahi-daemon
+++ b/profiles/apparmor.d/usr.sbin.avahi-daemon
@@ -1,7 +1,7 @@
 abi <abi/3.0>,

 include <tunables/global>
-profile avahi-daemon /usr/{bin,sbin}/avahi-daemon {
+profile avahi-daemon /usr/{bin,sbin}/avahi-daemon flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/consoles>
  include <abstractions/dbus>
--- a/profiles/apparmor.d/usr.sbin.dnsmasq
+++ b/profiles/apparmor.d/usr.sbin.dnsmasq
@@ -115,6 +115,9 @@ profile dnsmasq /usr/{bin,sbin}/dnsmasq flags=(attach_disconnected) {
  owner @{run}/user/*/containers/cni/dnsname/*/addnhosts r,
  owner @{run}/user/*/containers/cni/dnsname/*/pidfile rw,

+  # waydroid lxc-net pid file
+  @{run}/waydroid-lxc/dnsmasq.pid rw,
+
  profile libvirt_leaseshelper {
    include <abstractions/base>

@@ -127,6 +130,7 @@ profile dnsmasq /usr/{bin,sbin}/dnsmasq flags=(attach_disconnected) {
    owner @{PROC}/@{pid}/status r,

    @{sys}/devices/system/cpu/ r,
+    @{sys}/devices/system/cpu/possible r,
    @{sys}/devices/system/node/ r,
    @{sys}/devices/system/node/*/meminfo r,

--- a/profiles/apparmor.d/usr.sbin.nscd
+++ b/profiles/apparmor.d/usr.sbin.nscd
@@ -41,6 +41,10 @@ profile nscd /usr/{bin,sbin}/nscd {
  @{PROC}/@{pid}/fd/* r,
  @{PROC}/@{pid}/mounts r,

+  # systemd-userdb
+  /{etc,run,run/host,/usr/lib}/userdb/ r,
+  /{etc,run,run/host,/usr/lib}/userdb/*.{user,user-privileged,group,group-privileged} r,
+
  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/usr.sbin.nscd>
 }
--- a/profiles/apparmor.d/usr.sbin.smbd
+++ b/profiles/apparmor.d/usr.sbin.smbd
@@ -49,14 +49,14 @@ profile smbd /usr/{bin,sbin}/smbd {
  /usr/{bin,sbin}/smbldap-useradd Px,
  /var/cache/samba/** rwk,
  /var/{cache,lib}/samba/printing/printers.tdb mrw,
+  /var/lib/nscd/netgroup r,
  /var/lib/samba/** rwk,
  /var/lib/sss/pubconf/kdcinfo.* r,
  @{run}/dbus/system_bus_socket rw,
-  @{run}/smbd.pid rwk,
+  @{run}/{,samba/}smbd.pid rwk,
  @{run}/samba/** rk,
  @{run}/samba/ncalrpc/ rw,
  @{run}/samba/ncalrpc/** rw,
-  @{run}/samba/smbd.pid rw,
  /var/spool/samba/** rw,

  @{HOMEDIRS}/** lrwk,
--- a/profiles/apparmor/profiles/extras/bin.netstat
+++ b/profiles/apparmor/profiles/extras/bin.netstat
@@ -46,4 +46,7 @@ profile netstat /{usr/,}bin/netstat {
  @{PROC}/@{pid}/net/udplite r,
  @{PROC}/@{pid}/net/udplit6 r,
  @{PROC}/@{pid}/net/unix r,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/bin.netstat>
 }
--- a/profiles/apparmor/profiles/extras/etc.cron.daily.logrotate
+++ b/profiles/apparmor/profiles/extras/etc.cron.daily.logrotate
@@ -74,4 +74,7 @@ include <tunables/global>

  /var/spool/slrnpull/ wr,
  /var/spool/slrnpull/log* wrl,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/etc.cron.daily.logrotate>
 }
--- a/profiles/apparmor/profiles/extras/etc.cron.daily.slocate.cron
+++ b/profiles/apparmor/profiles/extras/etc.cron.daily.slocate.cron
@@ -25,4 +25,7 @@ include <tunables/global>
  /usr/bin/slocate                 mixr,
  /usr/bin/renice                  mixr,
  /**                              r   ,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/etc.cron.daily.slocate.cron>
 }
--- a/profiles/apparmor/profiles/extras/etc.cron.daily.tmpwatch
+++ b/profiles/apparmor/profiles/extras/etc.cron.daily.tmpwatch
@@ -22,4 +22,7 @@ include <tunables/global>
  /var/cache/man*/**        r,
  /var/tmp                  r,
  /var/tmp/**               rwl,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/etc.cron.daily.tmpwatch>
 }
--- a/profiles/apparmor/profiles/extras/postfix-anvil
+++ b/profiles/apparmor/profiles/extras/postfix-anvil
@@ -23,4 +23,7 @@ profile postfix-anvil /usr/lib/postfix/{bin/,sbin/,}anvil {
  /etc/postfix/main.cf                        r,
  /{var/spool/postfix/,}private/anvil         rw,
  /{var/spool/postfix/,}pid/unix.anvil        rwk,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-anvil>
 }
--- a/profiles/apparmor/profiles/extras/postfix-bounce
+++ b/profiles/apparmor/profiles/extras/postfix-bounce
@@ -47,4 +47,7 @@ profile postfix-bounce /usr/lib/postfix/{bin/,sbin/,}bounce {
  /{var/spool/postfix/,}pid/unix.bounce          rwk,
  /{var/spool/postfix/,}pid/unix.defer           rwk,
  /{var/spool/postfix/,}pid/unix.trace           rwk,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-bounce>
 }
--- a/profiles/apparmor/profiles/extras/postfix-cleanup
+++ b/profiles/apparmor/profiles/extras/postfix-cleanup
@@ -38,4 +38,7 @@ profile postfix-cleanup /usr/lib/postfix/{bin/,sbin/,}cleanup {

  /etc/{m,fs}tab                              r,
  /etc/postfix/*                              r,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-cleanup>
 }
--- a/profiles/apparmor/profiles/extras/postfix-discard
+++ b/profiles/apparmor/profiles/extras/postfix-discard
@@ -18,4 +18,7 @@ profile postfix-discard /usr/lib/postfix/{bin/,sbin/,}discard {
  include <abstractions/base>

  /usr/lib/postfix/{bin/,sbin/,}discard mrix,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-discard>
 }
--- a/profiles/apparmor/profiles/extras/postfix-dnsblog
+++ b/profiles/apparmor/profiles/extras/postfix-dnsblog
@@ -19,4 +19,7 @@ profile postfix-dnsblog /usr/lib/postfix/{bin/,sbin/,}dnsblog {
  /usr/lib/postfix/{bin/,sbin/,}dnsblog mrix,

  /var/spool/postfix/private/dnsblog rw,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-dnsblog>
 }
--- a/profiles/apparmor/profiles/extras/postfix-error
+++ b/profiles/apparmor/profiles/extras/postfix-error
@@ -26,4 +26,6 @@ profile postfix-error /usr/lib/postfix/{bin/,sbin/,}error {
  /var/spool/postfix/pid/unix.retry rwk,
  owner /var/spool/postfix/private/defer w,

+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-error>
 }
--- a/profiles/apparmor/profiles/extras/postfix-flush
+++ b/profiles/apparmor/profiles/extras/postfix-flush
@@ -40,4 +40,6 @@ profile postfix-flush /usr/lib/postfix/{bin/,sbin/,}flush {

  @{HOME}/.forward                            r,

+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-flush>
 }
--- a/profiles/apparmor/profiles/extras/postfix-lmtp
+++ b/profiles/apparmor/profiles/extras/postfix-lmtp
@@ -24,4 +24,6 @@ profile postfix-lmtp /usr/lib/postfix/{bin/,sbin/,}lmtp {
  /var/spool/postfix/active/* rwk,
  /var/spool/postfix/pid/unix.lmtp rwk,

+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-lmtp>
 }
--- a/profiles/apparmor/profiles/extras/postfix-local
+++ b/profiles/apparmor/profiles/extras/postfix-local
@@ -44,4 +44,7 @@ profile postfix-local /usr/lib/postfix/{bin/,sbin/,}local {
  /{var/spool/postfix/,}public/{cleanup,flush}          rw,
  # deliver mail
  /var/mail/*                                          wk,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-local>
 }
--- a/profiles/apparmor/profiles/extras/postfix-master
+++ b/profiles/apparmor/profiles/extras/postfix-master
@@ -58,4 +58,7 @@ profile postfix-master /usr/lib/postfix/{bin/,sbin/,}master {
  /usr/lib/postfix/{bin/,sbin/,}trivial-rewrite     Px,

  owner /var/lib/postfix/master.lock rwk,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-master>
 }
--- a/profiles/apparmor/profiles/extras/postfix-nqmgr
+++ b/profiles/apparmor/profiles/extras/postfix-nqmgr
@@ -45,4 +45,7 @@ profile postfix-nqmgr /usr/lib/postfix/{bin/,sbin/,}nqmgr {
  /{var/spool/postfix/,}private/local                             w,
  /{var/spool/postfix/,}public/flush                              w,
  /{var/spool/postfix/,}public/qmgr                               r,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-nqmgr>
 }
--- a/profiles/apparmor/profiles/extras/postfix-oqmgr
+++ b/profiles/apparmor/profiles/extras/postfix-oqmgr
@@ -20,4 +20,7 @@ profile postfix-oqmgr /usr/lib/postfix/{bin/,sbin/,}oqmgr {
  include <abstractions/postfix-common>

  /usr/lib/postfix/{bin/,sbin/,}oqmgr mrix,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-oqmgr>
 }
--- a/profiles/apparmor/profiles/extras/postfix-pickup
+++ b/profiles/apparmor/profiles/extras/postfix-pickup
@@ -24,4 +24,7 @@ profile postfix-pickup /usr/lib/postfix/{bin/,sbin/,}pickup {
  /{var/spool/postfix/,}public/pickup            r,
  /{var/spool/postfix/,}maildrop/                r,
  /{var/spool/postfix/,}maildrop/*               rwl,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-pickup>
 }
--- a/profiles/apparmor/profiles/extras/postfix-pipe
+++ b/profiles/apparmor/profiles/extras/postfix-pipe
@@ -27,4 +27,6 @@ profile postfix-pipe /usr/lib/postfix/{bin/,sbin/,}pipe {
  /var/spool/postfix/private/rewrite w,
  /var/spool/postfix/private/trace w,

+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-pipe>
 }
--- a/profiles/apparmor/profiles/extras/postfix-postscreen
+++ b/profiles/apparmor/profiles/extras/postfix-postscreen
@@ -16,4 +16,7 @@ profile postfix-postscreen /usr/lib/postfix/{bin/,sbin/,}postscreen {
  include <abstractions/base>

  /usr/lib/postfix/{bin/,sbin/,}postscreen mrix,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-postscreen>
 }
--- a/profiles/apparmor/profiles/extras/postfix-proxymap
+++ b/profiles/apparmor/profiles/extras/postfix-proxymap
@@ -23,4 +23,7 @@ profile postfix-proxymap /usr/lib/postfix/{bin/,sbin/,}proxymap {
  /etc/my.cnf r,
  /usr/lib/postfix/{bin/,sbin/,}proxymap     mrix,
  /{var/spool/postfix/,}private/proxymap     rw,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-proxymap>
 }
--- a/profiles/apparmor/profiles/extras/postfix-qmgr
+++ b/profiles/apparmor/profiles/extras/postfix-qmgr
@@ -51,4 +51,7 @@ profile postfix-qmgr /usr/lib/postfix/{bin/,sbin/,}qmgr {
  /{var/spool/postfix/,}private/smtp                              w,
  /{var/spool/postfix/,}private/trace                             w,
  /{var/spool/postfix/,}private/uucp                              w,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-qmgr>
 }
--- a/profiles/apparmor/profiles/extras/postfix-qmqpd
+++ b/profiles/apparmor/profiles/extras/postfix-qmqpd
@@ -19,4 +19,7 @@ profile postfix-qmqpd /usr/lib/postfix/{bin/,sbin/,}qmqpd {
  include <abstractions/postfix-common>

  /usr/lib/postfix/{bin/,sbin/,}qmqpd mrix,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-qmqpd>
 }
--- a/profiles/apparmor/profiles/extras/postfix-scache
+++ b/profiles/apparmor/profiles/extras/postfix-scache
@@ -21,4 +21,7 @@ profile postfix-scache /usr/lib/postfix/{bin/,sbin/,}scache {
  include <abstractions/postfix-common>

  /usr/lib/postfix/{bin/,sbin/,}scache mrix,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-scache>
 }
--- a/profiles/apparmor/profiles/extras/postfix-showq
+++ b/profiles/apparmor/profiles/extras/postfix-showq
@@ -48,4 +48,7 @@ profile postfix-showq /usr/lib/postfix/{bin/,sbin/,}showq {
  /{var/spool/postfix/,}pid/unix.showq                             rwk,
  owner /{var/spool/postfix,}/defer/[0-9A-F]/[0-9A-F]* r,
  owner /{var/spool/postfix,}/deferred/[0-9A-F]/[0-9A-F]* r,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-showq>
 }
--- a/profiles/apparmor/profiles/extras/postfix-smtp
+++ b/profiles/apparmor/profiles/extras/postfix-smtp
@@ -45,4 +45,7 @@ profile postfix-smtp /usr/lib/postfix/{bin/,sbin/,}smtp {
  /etc/postfix/prng_exch                      rw,
  /usr/share/ssl/certs/ca-bundle.crt          r,
  /etc/mtab                                   r,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-smtp>
 }
--- a/profiles/apparmor/profiles/extras/postfix-smtpd
+++ b/profiles/apparmor/profiles/extras/postfix-smtpd
@@ -52,4 +52,7 @@ profile postfix-smtpd /usr/lib/postfix/{bin/,sbin/,}smtpd {
  /{var/spool/postfix/,}public/cleanup           rw,

  /{,var/}run/sasl2/mux                             w,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-smtpd>
 }
--- a/profiles/apparmor/profiles/extras/postfix-spawn
+++ b/profiles/apparmor/profiles/extras/postfix-spawn
@@ -19,4 +19,7 @@ profile postfix-spawn /usr/lib/postfix/{bin/,sbin/,}spawn {
  include <abstractions/postfix-common>

  /usr/lib/postfix/{bin/,sbin/,}spawn mrix,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-spawn>
 }
--- a/profiles/apparmor/profiles/extras/postfix-tlsmgr
+++ b/profiles/apparmor/profiles/extras/postfix-tlsmgr
@@ -17,6 +17,7 @@ include <tunables/global>
 profile postfix-tlsmgr /usr/lib/postfix/{bin/,sbin/,}tlsmgr {
  include <abstractions/base>
  include <abstractions/nameservice>
+  include <abstractions/openssl>
  include <abstractions/postfix-common>

  /usr/lib/postfix/{bin/,sbin/,}tlsmgr mrix,
@@ -28,4 +29,7 @@ profile postfix-tlsmgr /usr/lib/postfix/{bin/,sbin/,}tlsmgr {
  /{,var/}run/smtpd_tls_session_cache.db rw,
  /var/lib/postfix/smtpd_scache.db rwk,
  /var/lib/postfix/smtp_scache.db rwk,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-tlsmgr>
 }
--- a/profiles/apparmor/profiles/extras/postfix-trivial-rewrite
+++ b/profiles/apparmor/profiles/extras/postfix-trivial-rewrite
@@ -26,4 +26,7 @@ profile postfix-trivial-rewrite /usr/lib/postfix/{bin/,sbin/,}trivial-rewrite {
  /etc/{m,fs}tab                              r,
  /var/spool/postfix/pid/unix.rewrite         rw,
  /{var/spool/postfix/,}private/rewrite       rw,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-trivial-rewrite>
 }
--- a/profiles/apparmor/profiles/extras/postfix-verify
+++ b/profiles/apparmor/profiles/extras/postfix-verify
@@ -19,4 +19,7 @@ profile postfix-verify /usr/lib/postfix/{bin/,sbin/,}verify {
  include <abstractions/postfix-common>

  /usr/lib/postfix/{bin/,sbin/,}verify mrix,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-verify>
 }
--- a/profiles/apparmor/profiles/extras/postfix-virtual
+++ b/profiles/apparmor/profiles/extras/postfix-virtual
@@ -23,4 +23,7 @@ profile postfix-virtual /usr/lib/postfix/{bin/,sbin/,}virtual {
  /var/spool/postfix/active/* rw,
  /var/spool/postfix/pid/unix.virtual rw,
  /var/spool/postfix/private/bounce w,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/postfix-virtual>
 }
--- a/profiles/apparmor/profiles/extras/sbin.dhclient
+++ b/profiles/apparmor/profiles/extras/sbin.dhclient
@@ -87,5 +87,6 @@ profile dhclient /{usr/,}sbin/dhclient {
  /var/lib/dhcp/* rw,
  /{,var/}run/nm-dhclient-*.conf r,

+  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/sbin.dhclient>
 }
--- a/profiles/apparmor/profiles/extras/sbin.dhclient-script
+++ b/profiles/apparmor/profiles/extras/sbin.dhclient-script
@@ -27,5 +27,6 @@ profile dhclient-script /{usr/,}sbin/dhclient-script {
  /{usr/,}sbin/ip rix,
  /{usr/,}sbin/resolvconf rPUx,

+  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/sbin.dhclient-script>
 }
--- a/profiles/apparmor/profiles/extras/sbin.dhcpcd
+++ b/profiles/apparmor/profiles/extras/sbin.dhcpcd
@@ -44,4 +44,7 @@ profile dhcpcd /{usr/,}sbin/dhcpcd {
  /var/lib/dhcpcd/dhcpcd-*.info rw,
  /var/lib/dhcpcd/dhcpcd-*.info.old rw,
  /{,var/}run/dhcpcd-*.pid rwl,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/sbin.dhcpcd>
 }
--- a/profiles/apparmor/profiles/extras/sbin.portmap
+++ b/profiles/apparmor/profiles/extras/sbin.portmap
@@ -23,4 +23,7 @@ profile portmap /{usr/,}sbin/portmap {

  /etc/bindresvport.blacklist r,
  /{usr/,}sbin/portmap         rmix,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/sbin.portmap>
 }
--- a/profiles/apparmor/profiles/extras/sbin.resmgrd
+++ b/profiles/apparmor/profiles/extras/sbin.resmgrd
@@ -31,4 +31,7 @@ profile resmgrd /{usr/,}sbin/resmgrd {
  /{,var/}run/fence* lrw,
  /{,var/}run/resmgr/classes/** wl,
  /{run,var}/lock/LCK* lrw,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/sbin.resmgrd>
 }
--- a/profiles/apparmor/profiles/extras/sbin.rpc.lockd
+++ b/profiles/apparmor/profiles/extras/sbin.rpc.lockd
@@ -15,4 +15,7 @@ include <tunables/global>
 profile rpc.lockd /{usr/,}sbin/rpc.lockd {
  include <abstractions/base>
  /{usr/,}sbin/rpc.lockd	rmix,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/sbin.rpc.lockd>
 }
--- a/profiles/apparmor/profiles/extras/sbin.rpc.statd
+++ b/profiles/apparmor/profiles/extras/sbin.rpc.statd
@@ -53,4 +53,7 @@ profile rpc.statd /{usr/,}sbin/rpc.statd {
  @{run}/rpc.statd.pid             w,
  @{run}/rpcbind.sock              rw,
  @{run}/sm-notify.pid             w,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/sbin.rpc.statd>
 }
--- a/profiles/apparmor/profiles/extras/usr.NX.bin.nxclient
+++ b/profiles/apparmor/profiles/extras/usr.NX.bin.nxclient
@@ -36,4 +36,7 @@ include <tunables/global>
  @{HOME}/.Xauthority-l     rwl,
  @{HOME}/.ssh/config       r,
  @{HOME}/.ssh/known_hosts  rw,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/usr.NX.bin.nxclient>
 }
--- a/profiles/apparmor/profiles/extras/usr.bin.acroread
+++ b/profiles/apparmor/profiles/extras/usr.bin.acroread
@@ -59,4 +59,7 @@ include <tunables/global>
  /usr/lib/jvm/java-*/jre/lib/fonts/** r,
  /usr/lib/ooo-*/share/fonts/** r,
  /usr/share/icons r,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/usr.bin.acroread>
 }
--- a/profiles/apparmor/profiles/extras/usr.bin.apropos
+++ b/profiles/apparmor/profiles/extras/usr.bin.apropos
@@ -25,4 +25,7 @@ include <tunables/global>
  /usr/bin/tr           mixr,
  /var/cache/man/whatis r,
  /var/cache/man/**     r,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/usr.bin.apropos>
 }
--- a/profiles/apparmor/profiles/extras/usr.bin.dumpcap
+++ b/profiles/apparmor/profiles/extras/usr.bin.dumpcap
@@ -38,4 +38,7 @@ include <tunables/global>

  owner /tmp/*pcap{,ng} rw,
  owner @{HOME}/**pcap{,ng} rw,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/usr.bin.dumpcap>
 }
--- a/profiles/apparmor/profiles/extras/usr.bin.evolution-2.10
+++ b/profiles/apparmor/profiles/extras/usr.bin.evolution-2.10
@@ -155,4 +155,7 @@ include <tunables/global>
  /usr/X11R6/lib/Acrobat7/Resource/Font r,
  /usr/X11R6/lib/Acrobat7/Resource/Font/** r,
  /var/tmp r,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/usr.bin.evolution-2.10>
 }
--- a/profiles/apparmor/profiles/extras/usr.bin.fam
+++ b/profiles/apparmor/profiles/extras/usr.bin.fam
@@ -21,4 +21,7 @@ include <tunables/global>
  # it makes some level of sense for FAM to read all files on the
  # filesystem, even if this is a little unfortunate.
  /** 			r,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/usr.bin.fam>
 }
--- a/profiles/apparmor/profiles/extras/usr.bin.freshclam
+++ b/profiles/apparmor/profiles/extras/usr.bin.freshclam
@@ -28,5 +28,6 @@ include <tunables/global>
  /var/lib/clamav/** rw,
  owner /run/clamav/freshclam.pid w,

+  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/usr.bin.freshclam>
 }
--- a/profiles/apparmor/profiles/extras/usr.bin.gaim
+++ b/profiles/apparmor/profiles/extras/usr.bin.gaim
@@ -66,4 +66,7 @@ include <tunables/global>
  /usr/share/icons r,
  /usr/share/tcl/tcl*/encoding/* r,
  /{,var/}run/.resmgr_socket w,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/usr.bin.gaim>
 }
--- a/profiles/apparmor/profiles/extras/usr.bin.man
+++ b/profiles/apparmor/profiles/extras/usr.bin.man
@@ -26,4 +26,6 @@ include <tunables/global>
  /usr/bin/man r,
  /usr/lib/man-db/man Px,

+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/usr.bin.man>
 }
--- a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-bounce
+++ b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-bounce
@@ -39,4 +39,7 @@ include <tunables/global>

  /usr/share/mlmmj/text.skel/*/* r,
  /var/spool/mlmmj/*/control/*  r,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/usr.bin.mlmmj-bounce>
 }
--- a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-maintd
+++ b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-maintd
@@ -51,4 +51,6 @@ include <tunables/global>
  /usr/share/mlmmj/text.skel/*/digest r,
  /var/spool/mlmmj/*/mlmmj.operation.log rwk,

+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/usr.bin.mlmmj-maintd>
 }
--- a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-make-ml.sh
+++ b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-make-ml.sh
@@ -43,4 +43,7 @@ include <tunables/global>
  /var/spool r,
  /var/spool/mlmmj rw,
  /var/spool/mlmmj/** w,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/usr.bin.mlmmj-make-ml.sh>
 }
--- a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-process
+++ b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-process
@@ -45,4 +45,6 @@ include <tunables/global>
  /var/spool/mlmmj/*/moderation/* rw,
  /etc/mlmmj/text/*/* r,

+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/usr.bin.mlmmj-process>
 }
--- a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-receive
+++ b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-receive
@@ -21,4 +21,7 @@ include <tunables/global>
  /usr/bin/mlmmj-receive mr,
  /var/spool/mlmmj/*/incoming/ rw,
  /var/spool/mlmmj/*/incoming/* rw,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/usr.bin.mlmmj-receive>
 }
--- a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-recieve
+++ b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-recieve
@@ -23,4 +23,7 @@ include <tunables/global>
  /usr/bin/mlmmj-process Px,
  /usr/bin/mlmmj-recieve mr,
  /var/spool/mlmmj/*/incoming/* w,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/usr.bin.mlmmj-recieve>
 }
--- a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-send
+++ b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-send
@@ -31,4 +31,6 @@ include <tunables/global>

  /var/spool/mlmmj/*/moderation/* rwk,

+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/usr.bin.mlmmj-send>
 }
--- a/profiles/apparmor/profiles/extras/usr.bin.mlmmj-sub
+++ b/profiles/apparmor/profiles/extras/usr.bin.mlmmj-sub
@@ -41,4 +41,6 @@ include <tunables/global>
  /var/spool/mlmmj/*/digesters.d/ rw,
  /var/spool/mlmmj/*/digesters.d/* rwk,

+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/usr.bin.mlmmj-sub>
 }
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .1.1
 .1.3
				`@@ -0,0 +1 @@`
				`type=AVC msg=audit(1661734785.992:270): apparmor="ALLOWED" operation="open" profile="/usr/bin/dolphin" name="/home/otis/.config/kdedefaults/kdeglobals" pid=3483 comm="dolphin" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0FSUID="otis" OUID="root"`
				`@@ -0,0 +1 @@`
				`Dec 15 17:32:17 kinetic kernel: [4835959.046111] audit: type=1107 audit(1671125537.724:209): pid=7308 uid=0 auid=4294967295 ses=4294967295 msg='apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/freedesktop/DBus" interface="org.freedesktop.DBus" method="Hello" mask="send" label="/tmp/apparmor/tests/regression/apparmor/dbus_message" peer_label="unconfined" exe="/usr/local/bin/dbus-broker" sauid=0 hostname=? addr=? terminal=?'`