Updated submodules: migrated n_signer verb names to nostr_ prefix

.gitmodules

@@ -0,0 +1,21 @@
+[submodule "includes/n_signer"]
+	path = includes/n_signer
+	url = ssh://git@git.laantungir.net:2222/laantungir/n_signer.git
+[submodule "includes/ginxsom"]
+	path = includes/ginxsom
+	url = ssh://git@git.laantungir.net:2222/laantungir/ginxsom.git
+[submodule "includes/nostr_core_lib"]
+	path = includes/nostr_core_lib
+	url = ssh://git@git.laantungir.net:2222/laantungir/nostr_core_lib.git
+[submodule "includes/nostr_terminal"]
+	path = includes/nostr_terminal
+	url = ssh://git@git.laantungir.net:2222/laantungir/nostr_terminal.git
+[submodule "includes/otp"]
+	path = includes/otp
+	url = ssh://git@git.laantungir.net:2222/laantungir/otp.git
+[submodule "includes/didactyl"]
+	path = includes/didactyl
+	url = ssh://git@git.laantungir.net:2222/laantungir/didactyl.git
+[submodule "includes/fips"]
+	path = includes/fips
+	url = ssh://git@git.laantungir.net:2222/laantungir/fips.git

.tmp_font_verify/rootfs/bin

@@ -0,0 +1 @@
+usr/bin

.tmp_font_verify/rootfs/boot/System.map-6.12.85+deb13-amd64

@@ -0,0 +1 @@
+ffffffffffffffff B The real System.map is in the linux-image-<version>-dbg package

.tmp_font_verify/rootfs/etc/adduser.conf

@@ -0,0 +1,116 @@
+# /etc/adduser.conf: `adduser' configuration.
+# See adduser(8) and adduser.conf(5) for full documentation.
+
+# A commented out setting indicates that this is the default in the
+# code. If you need to change those settings, remove the comment and
+# make your intended change.
+
+# STDERRMSGLEVEL, STDOUTMSGLEVEL, and LOGMSGLEVEL set the minimum
+# priority for messages logged to syslog/journal and the console,
+# respectively.
+# Values are trace, debug, info, warn, err, and fatal.
+# Messages with the set priority or higher get logged to the
+# respective medium.
+#STDOUTMSGLEVEL=warn
+#STDERRMSGLEVEL=warn
+#LOGMSGLEVEL=info
+
+# The login shell to be used for all new users.
+# Default: DSHELL=/bin/bash
+#DSHELL=/bin/bash
+
+# The directory in which new home directories should  be  created.
+# Default: DHOME=/home
+# DHOME=/home
+
+# The directory from which skeletal user configuration files
+# will be copied.
+# Default: SKEL=/etc/skel
+#SKEL=/etc/skel
+
+# Specify inclusive ranges of UIDs and GIDs from which UIDs and GIDs
+# for system users, system groups, non-system users and non-system groups
+# can be dynamically allocated.
+# Default: FIRST_SYSTEM_UID=100, LAST_SYSTEM_UID=999
+#FIRST_SYSTEM_UID=100
+#LAST_SYSTEM_UID=999
+
+# Default: FIRST_SYSTEM_GID=100, LAST_SYSTEM_GID=999
+#FIRST_SYSTEM_GID=100
+#LAST_SYSTEM_GID=999
+
+# Default: FIRST_UID=1000, LAST_UID=59999
+#FIRST_UID=1000
+#LAST_UID=59999
+
+# Default: FIRST_GID=1000, LAST_GID=59999
+#FIRST_GID=1000
+#LAST_GID=59999
+
+# Specify a file or a directory containing UID and GID pool.
+#UID_POOL=/etc/adduser-pool.conf
+#UID_POOL=/etc/adduser-pool.d/
+#GID_POOL=/etc/adduser-pool.conf
+#GID_POOL=/etc/adduser-pool.d/
+#RESERVE_UID_POOL=yes
+#RESERVE_GID_POOL=yes
+
+# Specify whether each created non-system user will be
+# given their own group to use.
+# Default: USERGROUPS=yes
+#USERGROUPS=yes
+
+# Defines the groupname or GID of the group all newly-created
+# non-system users are placed into.
+# It is a configuration error to define both variables
+# even if the values are consistent.
+# Default: USERS_GID=undefined, USERS_GROUP=users
+#USERS_GID=100
+#USERS_GROUP=users
+
+# The permissions mode for home directories of non-system users.
+# Default: DIR_MODE=0700
+#DIR_MODE=0700
+
+# The permissions mode for home directories of system users.
+# Default: SYS_DIR_MODE=0755
+#SYS_DIR_MODE=0755
+
+# If set to a nonempty value, new users will have quotas copied
+# from that user with `edquota -p QUOTAUSER newuser'
+# Default: QUOTAUSER=""
+#QUOTAUSER=""
+
+# Non-system user- and groupnames are checked against this regular
+# expression. RFC8265 would allow all codepoints U+0021 through U+007E
+# meaning: !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~ plus digits, lower case and
+# capital letters. ., / and : clash with special file names, path separator
+# and /etc/passwd format, many other characters might cause issues in shell
+# scripts. Therefore, the default is more restrictive than RFC8265 would
+# allow. Local administrators might relax this regexp as far as useradd
+# will allow.
+# Default: NAME_REGEX="^[a-zA-Z][a-zA-Z0-9_-]*\$?$"
+#NAME_REGEX="^[a-zA-Z][a-zA-Z0-9_-]*\$?$"
+
+# System user- and groupnames are checked against this regular
+# expression. Comments from above apply as well, but changes here may
+# affect package installation.
+# Default: SYS_NAME_REGEX="^[a-zA-Z_][a-zA-Z0-9_-]*\$?$"
+#SYS_NAME_REGEX="^[a-zA-Z_][a-zA-Z0-9_-]*\$?$"
+
+# When populating the newly created home directory of a non-system user,
+# files in SKEL matching this regex are not copied.
+# Default: SKEL_IGNORE_REGEX="\.(dpkg|ucf)-(old|new|dist|save)$"
+#SKEL_IGNORE_REGEX="\.(dpkg|ucf)-(old|new|dist|save)$"
+
+# list of groups that new non-system users will be added to
+# if ADD_EXTRA_GROUPS is non-zero or set on the command line.
+# Default: EXTRA_GROUPS="users"
+#EXTRA_GROUPS="users"
+
+# Setting this to something other than 0 will cause adduser to add
+# newly created non-system users to the list of groups defined by
+# EXTRA_GROUPS.
+# Default: ADD_EXTRA_GROUPS=0
+#ADD_EXTRA_GROUPS=0
+

.tmp_font_verify/rootfs/etc/adjtime

@@ -0,0 +1,3 @@
+0.0 0 0.0
+0
+UTC

.tmp_font_verify/rootfs/etc/alternatives/README

@@ -0,0 +1,2 @@
+Please read the update-alternatives(1) man page for information on this
+directory and its contents.

.tmp_font_verify/rootfs/etc/alternatives/awk

@@ -0,0 +1 @@
+/usr/bin/mawk

.tmp_font_verify/rootfs/etc/alternatives/awk.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/mawk.1.gz

.tmp_font_verify/rootfs/etc/alternatives/builtins.7.gz

@@ -0,0 +1 @@
+/usr/share/man/man7/bash-builtins.7.gz

.tmp_font_verify/rootfs/etc/alternatives/editor

@@ -0,0 +1 @@
+/bin/nano

.tmp_font_verify/rootfs/etc/alternatives/editor.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/nano.1.gz

.tmp_font_verify/rootfs/etc/alternatives/ex

@@ -0,0 +1 @@
+/usr/bin/vim.basic

.tmp_font_verify/rootfs/etc/alternatives/ex.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/ex.da.1.gz

@@ -0,0 +1 @@
+/usr/share/man/da/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/ex.de.1.gz

@@ -0,0 +1 @@
+/usr/share/man/de/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/ex.fr.1.gz

@@ -0,0 +1 @@
+/usr/share/man/fr/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/ex.it.1.gz

@@ -0,0 +1 @@
+/usr/share/man/it/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/ex.ja.1.gz

@@ -0,0 +1 @@
+/usr/share/man/ja/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/ex.pl.1.gz

@@ -0,0 +1 @@
+/usr/share/man/pl/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/ex.ru.1.gz

@@ -0,0 +1 @@
+/usr/share/man/ru/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/ex.tr.1.gz

@@ -0,0 +1 @@
+/usr/share/man/tr/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/mt

@@ -0,0 +1 @@
+/usr/bin/mt-gnu

.tmp_font_verify/rootfs/etc/alternatives/mt.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/mt-gnu.1.gz

.tmp_font_verify/rootfs/etc/alternatives/nawk

@@ -0,0 +1 @@
+/usr/bin/mawk

.tmp_font_verify/rootfs/etc/alternatives/nawk.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/mawk.1.gz

.tmp_font_verify/rootfs/etc/alternatives/pager

@@ -0,0 +1 @@
+/usr/bin/less

.tmp_font_verify/rootfs/etc/alternatives/pager.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/less.1.gz

.tmp_font_verify/rootfs/etc/alternatives/pico

@@ -0,0 +1 @@
+/bin/nano

.tmp_font_verify/rootfs/etc/alternatives/pico.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/nano.1.gz

.tmp_font_verify/rootfs/etc/alternatives/regulatory.db

@@ -0,0 +1 @@
+/lib/firmware/regulatory.db-debian

.tmp_font_verify/rootfs/etc/alternatives/regulatory.db.p7s

@@ -0,0 +1 @@
+/lib/firmware/regulatory.db.p7s-debian

.tmp_font_verify/rootfs/etc/alternatives/rmt

@@ -0,0 +1 @@
+/usr/sbin/rmt-tar

.tmp_font_verify/rootfs/etc/alternatives/rmt.8.gz

@@ -0,0 +1 @@
+/usr/share/man/man8/rmt-tar.8.gz

.tmp_font_verify/rootfs/etc/alternatives/rview

@@ -0,0 +1 @@
+/usr/bin/vim.basic

.tmp_font_verify/rootfs/etc/alternatives/rvim

@@ -0,0 +1 @@
+/usr/bin/vim.basic

.tmp_font_verify/rootfs/etc/alternatives/vi

@@ -0,0 +1 @@
+/usr/bin/vim.basic

.tmp_font_verify/rootfs/etc/alternatives/vi.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/vi.da.1.gz

@@ -0,0 +1 @@
+/usr/share/man/da/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/vi.de.1.gz

@@ -0,0 +1 @@
+/usr/share/man/de/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/vi.fr.1.gz

@@ -0,0 +1 @@
+/usr/share/man/fr/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/vi.it.1.gz

@@ -0,0 +1 @@
+/usr/share/man/it/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/vi.ja.1.gz

@@ -0,0 +1 @@
+/usr/share/man/ja/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/vi.pl.1.gz

@@ -0,0 +1 @@
+/usr/share/man/pl/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/vi.ru.1.gz

@@ -0,0 +1 @@
+/usr/share/man/ru/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/vi.tr.1.gz

@@ -0,0 +1 @@
+/usr/share/man/tr/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/view

@@ -0,0 +1 @@
+/usr/bin/vim.basic

.tmp_font_verify/rootfs/etc/alternatives/view.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/view.da.1.gz

@@ -0,0 +1 @@
+/usr/share/man/da/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/view.de.1.gz

@@ -0,0 +1 @@
+/usr/share/man/de/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/view.fr.1.gz

@@ -0,0 +1 @@
+/usr/share/man/fr/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/view.it.1.gz

@@ -0,0 +1 @@
+/usr/share/man/it/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/view.ja.1.gz

@@ -0,0 +1 @@
+/usr/share/man/ja/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/view.pl.1.gz

@@ -0,0 +1 @@
+/usr/share/man/pl/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/view.ru.1.gz

@@ -0,0 +1 @@
+/usr/share/man/ru/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/view.tr.1.gz

@@ -0,0 +1 @@
+/usr/share/man/tr/man1/vim.1.gz

.tmp_font_verify/rootfs/etc/alternatives/vim

@@ -0,0 +1 @@
+/usr/bin/vim.basic

.tmp_font_verify/rootfs/etc/alternatives/vimdiff

@@ -0,0 +1 @@
+/usr/bin/vim.basic

.tmp_font_verify/rootfs/etc/alternatives/which

@@ -0,0 +1 @@
+/usr/bin/which.debianutils

.tmp_font_verify/rootfs/etc/alternatives/which.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/which.debianutils.1.gz

.tmp_font_verify/rootfs/etc/alternatives/which.de1.gz

@@ -0,0 +1 @@
+/usr/share/man/de/man1/which.debianutils.1.gz

.tmp_font_verify/rootfs/etc/alternatives/which.es1.gz

@@ -0,0 +1 @@
+/usr/share/man/es/man1/which.debianutils.1.gz

.tmp_font_verify/rootfs/etc/alternatives/which.fr1.gz

@@ -0,0 +1 @@
+/usr/share/man/fr/man1/which.debianutils.1.gz

.tmp_font_verify/rootfs/etc/alternatives/which.it1.gz

@@ -0,0 +1 @@
+/usr/share/man/it/man1/which.debianutils.1.gz

.tmp_font_verify/rootfs/etc/alternatives/which.ja1.gz

@@ -0,0 +1 @@
+/usr/share/man/ja/man1/which.debianutils.1.gz

.tmp_font_verify/rootfs/etc/alternatives/which.pl1.gz

@@ -0,0 +1 @@
+/usr/share/man/pl/man1/which.debianutils.1.gz

.tmp_font_verify/rootfs/etc/alternatives/which.sl1.gz

@@ -0,0 +1 @@
+/usr/share/man/sl/man1/which.debianutils.1.gz

.tmp_font_verify/rootfs/etc/apparmor.d/1password

@@ -0,0 +1,12 @@
+# This profile allows everything and only exists to give the
+# application a name instead of having the label "unconfined"
+
+abi <abi/4.0>,
+include <tunables/global>
+
+profile 1password /opt/1Password/1password flags=(unconfined) {
+  userns,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/1password>
+}

.tmp_font_verify/rootfs/etc/apparmor.d/Discord

@@ -0,0 +1,12 @@
+# This profile allows everything and only exists to give the
+# application a name instead of having the label "unconfined"
+
+abi <abi/4.0>,
+include <tunables/global>
+
+profile Discord /usr/share/discord/Discord flags=(unconfined) {
+  userns,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/Discord>
+}

.tmp_font_verify/rootfs/etc/apparmor.d/MongoDB_Compass

@@ -0,0 +1,12 @@
+# This profile allows everything and only exists to give the
+# application a name instead of having the label "unconfined"
+
+abi <abi/4.0>,
+include <tunables/global>
+
+profile "MongoDB Compass" "/usr/lib/mongodb-compass/MongoDB Compass" flags=(unconfined) {
+  userns,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/MongoDB_Compass>
+}

.tmp_font_verify/rootfs/etc/apparmor.d/QtWebEngineProcess

@@ -0,0 +1,12 @@
+# This profile allows everything and only exists to give the
+# application a name instead of having the label "unconfined"
+
+abi <abi/4.0>,
+include <tunables/global>
+
+profile QtWebEngineProcess /usr/lib/@{multiarch}/qt{5,6}/libexec/QtWebEngineProcess flags=(unconfined) {
+  userns,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/QtWebEngineProcess>
+}

.tmp_font_verify/rootfs/etc/apparmor.d/Xorg

@@ -0,0 +1,123 @@
+# vim:syntax=apparmor
+# Author: Daniel Richard G. <skunk@iSKUNK.ORG>
+
+# Related:
+#   https://bugs.launchpad.net/bugs/1292324
+#   https://github.com/canonical/lightdm/issues/18
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+# Note: attach_disconnected appears necessary in rootless mode
+profile Xorg /usr/lib/xorg/Xorg flags=(complain,attach_disconnected, complain) {
+  include <abstractions/base>
+  include <abstractions/dbus-strict>
+  include <abstractions/fonts>
+  include <abstractions/mesa>
+  include <abstractions/nameservice>
+  include <abstractions/vulkan>
+  include <abstractions/X>
+
+  capability dac_override,
+  capability ipc_owner,
+  capability perfmon,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
+  capability sys_nice,
+  capability sys_rawio,
+
+  network netlink raw,
+
+  signal (receive) set=(hup, term),
+  signal (send) set=(usr1),
+
+  unix (accept, bind, listen, receive, send) type=stream addr="@/tmp/.X11-unix/X[0-9]*",
+
+  dbus (send)
+    bus=system
+    path=/org/freedesktop/login1
+    interface=org.freedesktop.login1.Manager
+    member=GetSessionByPID
+    peer=(name=org.freedesktop.login1),
+
+  dbus (send)
+    bus=system
+    path=/org/freedesktop/login1/session/*
+    interface=org.freedesktop.login1.Session
+    member={PauseDeviceComplete,ReleaseControl,ReleaseDevice,TakeControl,TakeDevice}
+    peer=(name=org.freedesktop.login1),
+
+  dbus (receive)
+    bus=system
+    path=/org/freedesktop/login1/session/*
+    interface=org.freedesktop.login1.Session
+    member=PauseDevice,
+
+  /{,usr/}bin/{bash,dash,sh} ix,
+  /usr/bin/xkbcomp           ix,
+
+  @{PROC}/cmdline         r,
+  @{PROC}/@{pid}/cmdline  r,
+  @{PROC}/ioports         r,
+  @{PROC}/mtrr            rw,
+
+  @{sys}/**/              r,
+  @{sys}/devices/**       r,
+  @{sys}/module/**        r,
+
+  @{sys}/devices/pci*/**/backlight/*/brightness rw,
+
+  # Display managers
+  @{run}/user/@{uid}/gdm/* r,
+  @{run}/lightdm/**        r,
+  @{run}/lxdm/*            r,
+  @{run}/sddm/*            r,
+  @{run}/slim.auth         r,
+  /var/lib/wdm/**          r,
+  /var/lib/xdm/**          r,
+
+  @{run}/nvidia-xdriver-*  rw,	# TODO: double-check
+  @{run}/udev/data/**      r,
+
+  /dev/dri/card[0-9]*      r,
+  /dev/fb0                 rw,
+  /dev/input/event*        rw,
+  /dev/tty[0-9]*           rw,
+  /dev/vga_arbiter         rw,
+
+  /etc/X11/** r,
+
+  owner /tmp/.tX[0-9]*-lock    rw,
+  owner /tmp/.X[0-9]*-lock     wl,
+  owner /tmp/serverauth.*      r,    # startx(1)
+  owner /tmp/server-[0-9]*.xkm rw,
+
+  /usr/lib/xorg/modules/   r,
+  /usr/lib/xorg/modules/** mr,
+  /usr/share/**            r,
+
+  owner /var/lib/xkb/**                 rw,
+  owner /var/log/Xorg.pid-[1-9]*.log    rw,
+  owner /var/log/Xorg.[0-9]*.log{,.old} rw,
+
+  # Rootless mode (gdm3, startx)
+  owner @{HOME}/.local/                                        w,
+  owner @{HOME}/.local/share/                                  w,
+  owner @{HOME}/.local/share/xorg/                             w,
+  owner @{HOME}/.local/share/xorg/Xorg.pid-[1-9]*.log          rw,
+  owner @{HOME}/.local/share/xorg/Xorg.[0-9]*.log{,.old}       rw,
+  owner /var/lib/gdm*/.cache/mesa_shader_cache/                rw,
+  owner /var/lib/gdm*/.cache/mesa_shader_cache/**              rwk,
+  owner /var/lib/gdm*/.local/share/xorg/Xorg.pid-[1-9]*.log    rw,
+  owner /var/lib/gdm*/.local/share/xorg/Xorg.[0-9]*.log{,.old} rw,
+
+  # When running without a kernel mode-setting (KMS) driver, Xorg may need
+  # these additional permissions. DO NOT enable these unless necessary!
+  #nokms#/dev/mem rw,
+  #nokms#@{sys}/devices/pci[0-9]*/*/*/resource[0-9] w,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/Xorg>
+}

.tmp_font_verify/rootfs/etc/apparmor.d/abi/3.0

@@ -0,0 +1,78 @@
+query {label {multi_transaction {yes
+}
+data {yes
+}
+perms {allow deny audit quiet
+}
+}
+}
+dbus {mask {acquire send receive
+}
+}
+signal {mask {hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost
+}
+}
+ptrace {mask {read trace
+}
+}
+caps {mask {chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon bpf
+}
+}
+rlimit {mask {cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime
+}
+}
+capability {0xffffff
+}
+namespaces {pivot_root {no
+}
+profile {yes
+}
+}
+mount {mask {mount umount pivot_root
+}
+}
+network {af_unix {yes
+}
+af_mask {unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp
+}
+}
+network_v8 {af_mask {unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp
+}
+}
+file {mask {create read write exec append mmap_exec link lock
+}
+}
+domain {version {1.2
+}
+attach_conditions {xattr {yes
+}
+}
+computed_longest_left {yes
+}
+post_nnp_subset {yes
+}
+fix_binfmt_elf_mmap {yes
+}
+stack {yes
+}
+change_profile {yes
+}
+change_onexec {yes
+}
+change_hatv {yes
+}
+change_hat {yes
+}
+}
+policy {set_load {yes
+}
+versions {v8 {yes
+}
+v7 {yes
+}
+v6 {yes
+}
+v5 {yes
+}
+}
+}

.tmp_font_verify/rootfs/etc/apparmor.d/abi/4.0

@@ -0,0 +1,91 @@
+capability {0xffffff
+}
+caps {mask {chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon bpf checkpoint_restore
+}
+}
+dbus {mask {acquire send receive
+}
+}
+domain {attach_conditions {xattr {yes
+}
+}
+change_hat {yes
+}
+change_hatv {yes
+}
+change_onexec {yes
+}
+change_profile {yes
+}
+computed_longest_left {yes
+}
+fix_binfmt_elf_mmap {yes
+}
+post_nnp_subset {yes
+}
+stack {yes
+}
+version {1.2
+}
+}
+file {mask {create read write exec append mmap_exec link lock
+}
+}
+ipc {posix_mqueue {create read write open delete setattr getattr
+}
+}
+mount {mask {mount umount pivot_root
+}
+}
+namespaces {mask {userns_create
+}
+pivot_root {no
+}
+profile {yes
+}
+}
+network {af_mask {unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp
+}
+af_unix {yes
+}
+}
+network_v8 {af_mask {unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp
+}
+}
+policy {outofband {0x000001
+}
+permstable32 {allow deny subtree cond kill complain prompt audit quiet hide xindex tag label
+}
+permstable32_version {0x000002
+}
+set_load {yes
+}
+versions {v5 {yes
+}
+v6 {yes
+}
+v7 {yes
+}
+v8 {yes
+}
+v9 {yes
+}
+}
+}
+ptrace {mask {read trace
+}
+}
+query {label {data {yes
+}
+multi_transaction {yes
+}
+perms {allow deny audit quiet
+}
+}
+}
+rlimit {mask {cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime
+}
+}
+signal {mask {hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost
+}
+}

.tmp_font_verify/rootfs/etc/apparmor.d/abi/kernel-5.4-outoftree-network

@@ -0,0 +1,76 @@
+query {label {multi_transaction {yes
+}
+data {yes
+}
+perms {allow deny audit quiet
+}
+}
+}
+dbus {mask {acquire send receive
+}
+}
+signal {mask {hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost
+}
+}
+ptrace {mask {read trace
+}
+}
+caps {mask {chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read
+}
+}
+rlimit {mask {cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime
+}
+}
+capability {0xffffff
+}
+namespaces {pivot_root {no
+}
+profile {yes
+}
+}
+mount {mask {mount umount pivot_root
+}
+}
+network {af_unix {yes
+}
+af_mask {unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp
+}
+}
+}
+file {mask {create read write exec append mmap_exec link lock
+}
+}
+domain {version {1.2
+}
+attach_conditions {xattr {yes
+}
+}
+computed_longest_left {yes
+}
+post_nnp_subset {yes
+}
+fix_binfmt_elf_mmap {yes
+}
+stack {yes
+}
+change_profile {yes
+}
+change_onexec {yes
+}
+change_hatv {yes
+}
+change_hat {yes
+}
+}
+policy {set_load {yes
+}
+versions {v8 {yes
+}
+v7 {yes
+}
+v6 {yes
+}
+v5 {yes
+}
+}
+}

.tmp_font_verify/rootfs/etc/apparmor.d/abi/kernel-5.4-vanilla

@@ -0,0 +1,68 @@
+query {label {multi_transaction {yes
+}
+data {yes
+}
+perms {allow deny audit quiet
+}
+}
+}
+signal {mask {hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost
+}
+}
+ptrace {mask {read trace
+}
+}
+caps {mask {chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read
+}
+}
+rlimit {mask {cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime
+}
+}
+capability {0xffffff
+}
+namespaces {pivot_root {no
+}
+profile {yes
+}
+}
+mount {mask {mount umount pivot_root
+}
+}
+}
+file {mask {create read write exec append mmap_exec link lock
+}
+}
+domain {version {1.2
+}
+attach_conditions {xattr {yes
+}
+}
+computed_longest_left {yes
+}
+post_nnp_subset {yes
+}
+fix_binfmt_elf_mmap {yes
+}
+stack {yes
+}
+change_profile {yes
+}
+change_onexec {yes
+}
+change_hatv {yes
+}
+change_hat {yes
+}
+}
+policy {set_load {yes
+}
+versions {v8 {yes
+}
+v7 {yes
+}
+v6 {yes
+}
+v5 {yes
+}
+}
+}

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/X

@@ -0,0 +1,67 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2002-2009 Novell/SUSE
+#    Copyright (C) 2009-2011 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+  abi <abi/4.0>,
+
+  include <abstractions/dri-common>
+
+
+  # .ICEauthority files required for X authentication, per user
+  owner @{HOME}/.ICEauthority r,
+  owner @{run}/user/*/ICEauthority r,
+
+  # .Xauthority files required for X connections, per user
+  owner @{HOME}/.Xauthority r,
+  owner @{HOME}/.local/share/sddm/.Xauthority r,
+  owner @{run}/gdm{,3}/*/database r,
+  owner @{run}/lightdm/authority/[0-9]* r,
+  owner @{run}/lightdm/*/xauthority r,
+  owner @{run}/user/*/gdm/Xauthority r,
+  owner @{run}/user/*/X11/Xauthority r,
+  owner @{run}/user/*/xauth_* r,
+  owner /tmp/xauth_?????? r,
+
+  # the unix socket to use to connect to the display
+  /tmp/.X11-unix/* rw,
+  unix (connect, receive, send)
+       type=stream
+       peer=(addr="@/tmp/.X11-unix/X[0-9]*"),
+  unix (connect, receive, send)
+       type=stream
+       peer=(addr="@/tmp/.ICE-unix/[0-9]*"),
+
+  /usr/include/X11/               r,
+  /usr/include/X11/**             r,
+
+  # The X tree changes and is large -- grant read access to the whole thing
+  /usr/X11R6/**                   r,
+  /usr/share/X11/                 r,
+  /usr/share/X11/**               r,
+  /usr/X11R6/**.so*               mr,
+
+  # EGL
+  /usr/lib/@{multiarch}/egl/*.so* mr,
+
+  # Xcompose
+  owner @{HOME}/.XCompose         r,
+  /var/cache/libx11/compose/*     r,
+  deny /var/cache/libx11/compose/* wlk,
+
+  # mouse themes
+  /etc/X11/cursors/               r,
+  /etc/X11/cursors/**             r,
+
+  # Xwayland
+  owner @{run}/user/*/.mutter-Xwaylandauth.* r,
+
+  # Include additions to the abstraction
+  include if exists <abstractions/X.d>

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/apache2-common

@@ -0,0 +1,43 @@
+# vim:syntax=apparmor
+
+# This file contains basic permissions for Apache and every vHost
+
+  abi <abi/4.0>,
+
+  include <abstractions/nameservice>
+
+  # Allow other processes to read our /proc entries
+  ptrace (readby),
+  # Allow other processes to trace us by default
+  ptrace (tracedby),
+  # Allow unconfined processes to send us signals by default
+  signal (receive) peer=unconfined,
+  # Allow apache to send us signals by default
+  signal (receive) peer=apache2,
+  # Allow other hats to signal by default
+  signal peer=apache2//*,
+  # Allow us to signal ourselves
+  signal peer=@{profile_name},
+
+  # Apache
+  network inet stream,
+  network inet6 stream,
+  # apache manual, error pages and icons
+  /usr/share/apache2/** r,
+
+  # changehat itself
+  @{PROC}/@{pid}/attr/{apparmor/,}current                        rw,
+
+  # htaccess files - for what ever it is worth
+  /**/.htaccess            r,
+
+  /dev/urandom            r,
+
+  # sasl-auth
+  @{run}/saslauthd/mux rw,
+
+  # OCSP stapling
+  @{run}/lock/apache2/stapling-cache* rw,
+
+  # Include additions to the abstraction
+  include if exists <abstractions/apache2-common.d>

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/apparmor_api/change_profile

@@ -0,0 +1,13 @@
+#    Copyright (C) 2012 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/4.0>,
+
+include <abstractions/apparmor_api/introspect>
+
+@{PROC}/@{tid}/attr/{apparmor/,}{current,exec} w,

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/apparmor_api/examine

@@ -0,0 +1,14 @@
+#    Copyright (C) 2012 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+# Make sure to include at least tunables/proc and tunables/kernelvars
+# when using this abstraction, if not tunables/global.
+
+abi <abi/4.0>,
+
+@{PROC}/@{pids}/attr/{apparmor/,}{current,prev,exec} r,

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/apparmor_api/find_mountpoint

@@ -0,0 +1,16 @@
+#    Copyright (C) 2012 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/4.0>,
+
+#permissions needed for aa_find_mountpoint
+
+# Make sure to include at least tunables/proc and tunables/kernelvars
+# when using this abstraction, if not tunables/global.
+
+@{PROC}/@{pids}/mounts r,

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/apparmor_api/introspect

@@ -0,0 +1,14 @@
+#    Copyright (C) 2012 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/4.0>,
+
+# Make sure to include at least tunables/proc and tunables/kernelvars
+# when using this abstraction, if not tunables/global.
+
+@{PROC}/@{tid}/attr/{apparmor/,}{current,prev,exec} r,

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/apparmor_api/is_enabled

@@ -0,0 +1,20 @@
+#    Copyright (C) 2012 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/4.0>,
+
+# permissions needed for aa_is_enabled
+
+# Make sure to include tunables/apparmorfs and tunables/global
+# when using this abstraction
+
+include <abstractions/apparmor_api/find_mountpoint>
+@{sys}/module/apparmor/parameters/enabled r,
+@{sys}/module/apparmor/parameters/available r,
+
+# TODO: add alternate apparmorfs interface for enabled

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/aspell

@@ -0,0 +1,18 @@
+# vim:syntax=apparmor
+# aspell permissions
+
+  abi <abi/4.0>,
+
+  # per-user settings and dictionaries
+  owner @{HOME}/.aspell.*.{pws,prepl} rwk,
+
+  # system libraries and dictionaries
+  /usr/lib/aspell/ r,
+  /usr/lib/aspell/* r,
+  /usr/lib/aspell/*.so m,
+  /usr/share/aspell/ r,
+  /usr/share/aspell/* r,
+  /var/lib/aspell/* r,
+
+  # Include additions to the abstraction
+  include if exists <abstractions/aspell.d>

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/audio

@@ -0,0 +1,93 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2002-2009 Novell/SUSE
+#    Copyright (C) 2009 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/4.0>,
+
+
+/dev/admmidi*   rw,
+/dev/adsp*      rw,
+/dev/aload*     rw,
+/dev/amidi*     rw,
+/dev/audio*     rw,
+/dev/dmfm*      rw,
+/dev/dmmidi*    rw,
+/dev/dsp*       rw,
+/dev/midi*      rw,
+/dev/mixer*     rw,
+/dev/mpu401data rw,
+/dev/mpu401stat rw,
+/dev/patmgr*    rw,
+/dev/phone*     rw,
+/dev/radio*     rw,
+/dev/rmidi*     rw,
+/dev/sequencer  rw,
+/dev/sequencer2 rw,
+/dev/smpte*     rw,
+
+/dev/snd/*      rw,
+/dev/sound/*    rw,
+
+@{PROC}/asound/** rw,
+
+/usr/share/alsa/** r,
+/usr/share/sounds/ r,
+/usr/share/sounds/** r,
+
+owner @{HOME}/.esd_auth r,
+/etc/asound.conf r,
+owner @{HOME}/.asoundrc r,
+/etc/esound/esd.conf r,
+
+# libao
+/etc/libao.conf r,
+owner @{HOME}/.libao r,
+
+# libcanberra
+owner @{HOME}/.cache/event-sound-cache.* rwk,
+
+# pulse
+/etc/pulse/ r,
+/etc/pulse/** r,
+/dev/shm/ r,
+@{run}/shm/ r,
+owner /dev/shm/pulse-shm* rwk,
+owner @{run}/shm/pulse-shm* rwk,
+owner @{HOME}/.pulse-cookie rwk,
+owner @{HOME}/.pulse/ rw,
+owner @{HOME}/.pulse/* rwk,
+owner @{run}/user/*/pulse/  rw,
+owner @{run}/user/*/pulse/{native,pid} rwk,
+owner @{HOME}/.config/pulse/*.conf r,
+owner @{HOME}/.config/pulse/client.conf.d/{,*.conf} r,
+owner @{HOME}/.config/pulse/cookie rwk,
+owner /tmp/pulse-*/ rw,
+owner /tmp/pulse-*/* rw,
+
+# libgnome2
+/etc/sound/ r,
+/etc/sound/** r,
+
+# openal
+/etc/alsa/conf.d/{,*} r,
+/etc/openal/alsoft.conf r,
+owner @{HOME}/.alsoftrc r,
+/usr/{,local/}share/openal/hrtf/{,**} r,
+owner @{HOME}/.local/share/openal/hrtf/{,**} r,
+
+# wildmidi
+/etc/wildmidi/wildmidi.cfg r,
+
+# pipewire
+/usr/share/pipewire/client{,-rt}.conf r,
+
+  # Include additions to the abstraction
+  include if exists <abstractions/audio.d>

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/authentication

@@ -0,0 +1,74 @@
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2002-2009 Novell/SUSE
+#    Copyright (C) 2009-2012 Canonical Ltd
+#    Copyright (C) 2019-2021 Christian Boltz
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+  abi <abi/4.0>,
+
+
+  # Some services need to perform authentication of users
+  # Such authentication almost certainly needs access to the local users
+  # databases containing passwords, PAM configuration files, PAM libraries
+  @{etc_ro}/nologin                r,
+  @{etc_ro}/pam.d/*                r,
+  @{etc_ro}/securetty              r,
+  @{etc_ro}/security/*             r,
+  @{etc_ro}/shadow                 r,
+  @{etc_ro}/gshadow                r,
+  @{etc_ro}/pwdb.conf              r,
+
+  /{usr/,}lib{,32,64}/security/pam_filter/*  mr,
+  /{usr/,}lib{,32,64}/security/pam_*.so      mr,
+  /{usr/,}lib{,32,64}/security/              r,
+  /{usr/,}lib/@{multiarch}/security/pam_filter/*  mr,
+  /{usr/,}lib/@{multiarch}/security/pam_*.so      mr,
+  /{usr/,}lib/@{multiarch}/security/              r,
+
+  # pam_unix
+  owner /proc/@{pid}/loginuid r,
+  /{,usr/}{,s}bin/unix_chkpwd Px,
+
+  # pam_env
+  @{etc_ro}/environment r,
+
+  # pam_limit
+  @{etc_ro}/security/limits.d/ r,
+  @{etc_ro}/security/limits.d/*.conf  r,
+
+  # gssapi
+  @{etc_ro}/gss/mech               r,
+  @{etc_ro}/gss/mech.d/            r,
+  @{etc_ro}/gss/mech.d/*.conf      r,
+
+  # kerberos
+  include <abstractions/kerberosclient>
+  # SuSE's pwdutils are different:
+  @{etc_ro}/default/passwd         r,
+  @{etc_ro}/login.defs             r,
+  @{etc_ro}/login.defs.d/          r,
+  @{etc_ro}/login.defs.d/*.defs    r,
+
+  # nis
+  include <abstractions/nis>
+
+  # winbind
+  include <abstractions/winbind>
+
+  # likewise
+  include <abstractions/likewise>
+
+  # smbpass
+  include <abstractions/smbpass>
+
+  # p11-kit (PKCS#11 modules configuration)
+  include <abstractions/p11-kit>
+
+  # Include additions to the abstraction
+  include if exists <abstractions/authentication.d>

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/base

@@ -0,0 +1,185 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2002-2009 Novell/SUSE
+#    Copyright (C) 2009-2011 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+  abi <abi/4.0>,
+
+  include <abstractions/crypto>
+
+  # (Note that the ldd profile has inlined this file; if you make
+  # modifications here, please consider including them in the ldd
+  # profile as well.)
+
+  # The __canary_death_handler function writes a time-stamped log
+  # message to /dev/log for logging by syslogd. So, /dev/log, timezones,
+  # and localisations of date should be available EVERYWHERE, so
+  # StackGuard, FormatGuard, etc., alerts can be properly logged.
+  /dev/log                       w,
+  /dev/random                    r,
+  /dev/urandom                   r,
+  # Allow access to the uuidd daemon (this daemon is a thin wrapper around
+  # time and getrandom()/{,u}random and, when available, runs under an
+  # unprivilged, dedicated user).
+  @{run}/uuidd/request           r,
+  @{etc_ro}/locale/**          r,
+  @{etc_ro}/locale.alias       r,
+  @{etc_ro}/localtime          r,
+  @{etc_rw}/localtime          r,
+  /etc/writable/localtime        r,
+  /usr/share/locale-bundle/**    r,
+  /usr/share/locale-langpack/**  r,
+  /usr/share/locale/             r,
+  /usr/share/locale/**           r,
+  /usr/share/**/locale/**        r,
+  /usr/share/zoneinfo{,-icu}/    r,
+  /usr/share/zoneinfo{,-icu}/**  r,
+  /usr/share/X11/locale/**       r,
+  @{run}/systemd/journal/dev-log w,
+  # systemd native journal API (see sd_journal_print(4))
+  @{run}/systemd/journal/socket  w,
+  # Nested containers and anything using systemd-cat need this. 'r' shouldn't
+  # be required but applications fail without it. journald doesn't leak
+  # anything when reading so this is ok.
+  @{run}/systemd/journal/stdout  rw,
+
+  /usr/lib{,32,64}/locale/**             mr,
+  /usr/lib{,32,64}/gconv/*.so            mr,
+  /usr/lib{,32,64}/gconv/gconv-modules*  mr,
+  /usr/lib/@{multiarch}/gconv/*.so           mr,
+  /usr/lib/@{multiarch}/gconv/gconv-modules* mr,
+
+  # used by glibc when binding to ephemeral ports
+  @{etc_ro}/bindresvport.blacklist    r,
+
+  # ld.so.cache and ld are used to load shared libraries; they are best
+  # available everywhere
+  @{etc_ro}/ld.so.cache               mr,
+  @{etc_ro}/ld.so.conf                r,
+  @{etc_ro}/ld.so.conf.d/{,*.conf}    r,
+  @{etc_ro}/ld.so.preload             r,
+  @{etc_ro}/ld-musl-*.path            r,
+  /{usr/,}lib{,32,64}/ld{,32,64}-*.so   mr,
+  /{usr/,}lib/@{multiarch}/ld{,32,64}-*.so    mr,
+  /{usr/,}lib/tls/i686/{cmov,nosegneg}/ld-*.so     mr,
+  /{usr/,}lib/i386-linux-gnu/tls/i686/{cmov,nosegneg}/ld-*.so     mr,
+  /opt/*-linux-uclibc/lib/ld-uClibc*so* mr,
+
+  # we might as well allow everything to use common libraries
+  /{usr/,}lib{,32,64}/**                r,
+  /{usr/,}lib{,32,64}/**.so*       mr,
+  /{usr/,}lib/@{multiarch}/**            r,
+  /{usr/,}lib/@{multiarch}/**.so*   mr,
+  /{usr/,}lib/tls/i686/{cmov,nosegneg}/*.so*    mr,
+  /{usr/,}lib/i386-linux-gnu/tls/i686/{cmov,nosegneg}/*.so*    mr,
+
+  # FIPS-140-2 versions of some crypto libraries need to access their
+  # associated integrity verification file, or they will abort.
+  /{usr/,}lib{,32,64}/.lib*.so*.hmac      r,
+  /{usr/,}lib/@{multiarch}/.lib*.so*.hmac r,
+
+  # /dev/null is pretty harmless and frequently used
+  /dev/null                      rw,
+  # as is /dev/zero
+  /dev/zero                      rw,
+  # recent glibc uses /dev/full in preference to /dev/null for programs
+  # that don't have open fds at exec()
+  /dev/full                      rw,
+
+  # Sometimes used to determine kernel/user interfaces to use
+  @{PROC}/sys/kernel/version     r,
+  # Depending on which glibc routine uses this file, base may not be the
+  # best place -- but many profiles require it, and it is quite harmless.
+  @{PROC}/sys/kernel/ngroups_max r,
+
+  # Used to determine if Linux is running in FIPS mode
+  @{PROC}/sys/crypto/fips_enabled r,
+
+  # glibc's sysconf(3) routine to determine free memory, etc
+  @{PROC}/meminfo                r,
+  @{PROC}/stat                   r,
+  @{PROC}/cpuinfo                r,
+  @{sys}/devices/system/cpu/       r,
+  @{sys}/devices/system/cpu/online r,
+  @{sys}/devices/system/cpu/possible r,
+
+  # transparent hugepage support
+  @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
+
+  # glibc's *printf protections read the maps file
+  @{PROC}/@{pid}/{maps,auxv,status} r,
+
+  # some applications will display license information
+  /usr/share/common-licenses/**  r,
+
+  # glibc statvfs
+  @{PROC}/filesystems            r,
+
+  # glibc malloc (man 5 proc)
+  @{PROC}/sys/vm/overcommit_memory r,
+
+  # Allow determining the highest valid capability of the running kernel
+  @{PROC}/sys/kernel/cap_last_cap r,
+
+  # Allow other processes to read our /proc entries, futexes, perf tracing and
+  # kcmp for now (they will need 'read' in the first place). Administrators can
+  # override with:
+  #   deny ptrace (readby) ...
+  ptrace (readby),
+
+  # Allow other processes to trace us by default (they will need 'trace' in
+  # the first place). Administrators can override with:
+  #   deny ptrace (tracedby) ...
+  ptrace (tracedby),
+
+  # Allow us to ptrace read ourselves
+  ptrace (read) peer=@{profile_name},
+
+  # Allow unconfined processes to send us signals by default
+  signal (receive) peer=unconfined,
+
+  # Allow us to signal ourselves
+  signal peer=@{profile_name},
+
+  # Checking for PID existence is quite common so add it by default for now
+  signal (receive, send) set=("exists"),
+
+  # Allow us to create and use abstract and anonymous sockets
+  unix peer=(label=@{profile_name}),
+
+  # Allow unconfined processes to us via unix sockets
+  unix (receive) peer=(label=unconfined),
+
+  # Allow us to create abstract and anonymous sockets
+  unix (create),
+
+  # Allow us to getattr, getopt, setop and shutdown on unix sockets
+  unix (getattr, getopt, setopt, shutdown),
+
+  # Workaround https://launchpad.net/bugs/359338 until upstream handles stacked
+  # filesystems generally. This does not appreciably decrease security with
+  # Ubuntu profiles because the user is expected to have access to files owned
+  # by him/her. Exceptions to this are explicit in the profiles. While this rule
+  # grants access to those exceptions, the intended privacy is maintained due to
+  # the encrypted contents of the files in this directory. Files in this
+  # directory will also use filename encryption by default, so the files are
+  # further protected. Also, with the use of 'owner', this rule properly
+  # prevents access to the files from processes running under a different uid.
+
+  # encrypted ~/.Private and old-style encrypted $HOME
+  owner @{HOME}/.Private/ r,
+  owner @{HOME}/.Private/** mrixwlk,
+  # new-style encrypted $HOME
+  owner @{HOMEDIRS}/.ecryptfs/*/.Private/ r,
+  owner @{HOMEDIRS}/.ecryptfs/*/.Private/** mrixwlk,
+
+
+  # Include additions to the abstraction
+  include if exists <abstractions/base.d>

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/bash

@@ -0,0 +1,49 @@
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2002-2006 Novell/SUSE
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+  abi <abi/4.0>,
+
+  # user-specific bash files
+  @{HOMEDIRS}                      r,
+  @{HOME}/.bashrc                  r,
+  @{HOME}/.profile                 r,
+  @{HOME}/.bash_profile            r,
+  @{HOME}/.bash_history            rw,
+
+  # system-wide bash configuration
+  /etc/profile.dos                 r,
+  /etc/profile                     r,
+  /etc/profile.d/                  r,
+  /etc/profile.d/*                 r,
+  /etc/bashrc                      r,
+  /etc/bash.bashrc                 r,
+  /etc/bash.bashrc.local           r,
+  /etc/bash_completion             r,
+  /etc/bash_completion.d/          r,
+  /etc/bash_completion.d/*         r,
+
+  # bash relies on system-wide readline configuration
+  /etc/inputrc                     r,
+
+  # bash inspects filesystems at startup
+  /etc/mtab                        r,
+  @{PROC}/@{pid}/mounts            r,
+  @{PROC}/filesystems              r,
+
+  # probably readline wants to know terminal capabilities
+  /usr/share/terminfo/**           r,
+
+  # run out of /etc/bash.bashrc
+  /etc/DIR_COLORS                  r,
+  /{usr/,}bin/ls                   mix,
+  /usr/bin/dircolors               mix,
+
+  # Include additions to the abstraction
+  include if exists <abstractions/bash.d>

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/consoles

@@ -0,0 +1,27 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2002-2005 Novell/SUSE
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+  abi <abi/4.0>,
+
+
+  # there are three common ways to refer to consoles
+  /dev/console rw,
+  /dev/tty     rw,
+  # this next entry is a tad unfortunate; /dev/tty will always be
+  # associated with the controlling terminal by the kernel, but if a
+  # program uses the /dev/pts/ interface, it actually has access to
+  # -all- xterm, sshd, etc, terminals on the system.
+  /dev/pts/[0-9]*   rw,
+  /dev/pts/         r,
+
+
+  # Include additions to the abstraction
+  include if exists <abstractions/consoles.d>

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/crypto

@@ -0,0 +1,34 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2002-2009 Novell/SUSE
+#    Copyright (C) 2009-2011 Canonical Ltd.
+#    Copyright (C) 2021 Christian Boltz
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+  abi <abi/4.0>,
+
+  # Global config of openssl
+  include <abstractions/openssl>
+
+  @{etc_ro}/gcrypt/hwf.deny r,
+  @{etc_ro}/gcrypt/random.conf r,
+  @{PROC}/sys/crypto/fips_enabled r,
+
+  # libgcrypt reads some flags from /proc
+  @{PROC}/sys/crypto/* r,
+
+  # crypto policies used by various libraries
+  /etc/crypto-policies/*/*.txt r,
+  /usr/share/crypto-policies/*/*.txt r,
+
+  # Global gnutls config
+  @{etc_ro}/gnutls/config r,
+  @{etc_ro}/gnutls/pkcs11.conf r,
+
+  include if exists <abstractions/crypto.d>

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/cups-client

@@ -0,0 +1,23 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2009-2012 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+  abi <abi/4.0>,
+
+  # discoverable system configuration for non-local cupsd
+  /etc/cups/client.conf   r,
+  # client should be able to talk the local cupsd
+  @{run}/cups/cups.sock   rw,
+  # client should be able to read user-specified cups configuration
+  owner @{HOME}/.cups/client.conf r,
+  owner @{HOME}/.cups/lpoptions r,
+
+  # Include additions to the abstraction
+  include if exists <abstractions/cups-client.d>

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/dbus

@@ -0,0 +1,21 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2009-2013 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+  abi <abi/4.0>,
+
+  # This abstraction grants full system bus access. Consider using the
+  # dbus-strict abstraction for fine-grained bus mediation.
+
+  include <abstractions/dbus-strict>
+  dbus bus=system,
+
+  # Include additions to the abstraction
+  include if exists <abstractions/dbus.d>

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/dbus-accessibility

@@ -0,0 +1,21 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2013 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+  abi <abi/4.0>,
+
+  # This abstraction grants full accessibility bus access. Consider using the
+  # dbus-accessibility-strict abstraction for fine-grained bus mediation.
+
+  include <abstractions/dbus-accessibility-strict>
+  dbus bus=accessibility,
+
+  # Include additions to the abstraction
+  include if exists <abstractions/dbus-accessibility.d>

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/dbus-accessibility-strict

@@ -0,0 +1,22 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2013 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+  abi <abi/4.0>,
+
+  dbus send
+       bus=accessibility
+       path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus
+       member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
+       peer=(name=org.freedesktop.DBus),
+
+  # Include additions to the abstraction
+  include if exists <abstractions/dbus-accessibility-strict.d>

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/dbus-network-manager-strict

@@ -0,0 +1,47 @@
+# vim:syntax=apparmor
+
+  abi <abi/4.0>,
+
+  dbus send
+       bus=system
+       path=/org/freedesktop/NetworkManager
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=org.freedesktop.NetworkManager),
+
+  dbus send
+       bus=system
+       path=/org/freedesktop/NetworkManager
+       interface=org.freedesktop.NetworkManager
+       member=GetDevices
+       peer=(name=org.freedesktop.NetworkManager),
+
+  dbus send
+       bus=system
+       path=/org/freedesktop/NetworkManager/ActiveConnection/[0-9]*
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=org.freedesktop.NetworkManager),
+
+  dbus send
+       bus=system
+       path=/org/freedesktop/NetworkManager/Devices/[0-9]*
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=org.freedesktop.NetworkManager),
+
+  dbus send
+       bus=system
+       path=/org/freedesktop/NetworkManager/Settings
+       interface=org.freedesktop.NetworkManager.Settings
+       member={GetDevices,ListConnections}
+       peer=(name=org.freedesktop.NetworkManager),
+
+  dbus send
+       bus=system
+       path=/org/freedesktop/NetworkManager/Settings/[0-9]*
+       interface=org.freedesktop.NetworkManager.Settings.Connection
+       member=GetSettings
+       peer=(name=org.freedesktop.NetworkManager),
+
+  include if exists <abstractions/dbus-network-manager-strict.d>

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/dbus-session

@@ -0,0 +1,22 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2011-2013 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+  abi <abi/4.0>,
+
+  # This abstraction grants full session bus access. Consider using the
+  # dbus-session-strict abstraction for fine-grained bus mediation.
+
+  include <abstractions/dbus-session-strict>
+  /usr/bin/dbus-launch ix,
+  dbus bus=session,
+
+  # Include additions to the abstraction
+  include if exists <abstractions/dbus-session.d>

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/dbus-session-strict

@@ -0,0 +1,39 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2011-2013 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+  abi <abi/4.0>,
+
+  # unique per-machine identifier
+  /etc/machine-id r,
+  /var/lib/dbus/machine-id r,
+
+  unix (connect, receive, send, accept) type=stream peer=(addr="@/tmp/dbus-*"),
+
+  unix (connect, send, receive, accept) type=stream addr="@/tmp/dbus-*",
+  unix (bind, listen) type=stream addr="@/tmp/dbus-*",
+
+  # dbus with systemd and --enable-user-session
+  owner @{run}/user/[0-9]*/bus rw,
+
+  dbus send
+       bus=session
+       path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus
+       member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
+       peer=(name=org.freedesktop.DBus),
+
+  owner @{run}/user/@{uid}/at-spi/ rw,
+  owner @{run}/user/@{uid}/at-spi/bus{,_[0-9]*} rw,
+
+  owner /tmp/dbus-[0-9a-zA-Z]* rw,
+
+  # Include additions to the abstraction
+  include if exists <abstractions/dbus-session-strict.d>

.tmp_font_verify/rootfs/etc/apparmor.d/abstractions/dbus-strict

@@ -0,0 +1,24 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2009-2013 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+  abi <abi/4.0>,
+
+  @{run}/dbus/system_bus_socket rw,
+
+  dbus send
+       bus=system
+       path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus
+       member={Hello,AddMatch,RemoveMatch,GetNameOwner,NameHasOwner,StartServiceByName}
+       peer=(name=org.freedesktop.DBus),
+
+  # Include additions to the abstraction
+  include if exists <abstractions/dbus-strict.d>