Update profiles for usrmerge

> ./abstractions/lightdm: /bin/ rmix,

rmix permissions for a directory? That looks wrong to me, r permissions should be enough.

If https://wiki.debian.org/UsrMerge is what we follow here then the libvirt rules for:
 /sbin/* PUx and /bin/* PUx are ok, they already have /usr/bin/* and /usr/sbin/* present.
(part of a very lenient profile I know)
They are also not part of the Ubuntu Delta, so we can leave those rules as-is.

More interesting are the lines in abstractions/libvirt-qemu
Those are of a powerpc specific delta we carry and refer to just /bin at the moment.
   /bin/uname rmix,
   /bin/grep rmix,
I guess if we'd convert those two on the next merge to
   /{usr/,}bin/uname rmix,
   /{usr/,}bin/grep rmix,
we will be safe for the usr merge and still very backward compatible.
I'll do that as part of the coming cosmic libvirt merge which is blocked by a few other things (so it will take a bit).
But I'll call this packages task triaged and assign it to me.

To reduce unintentional breakage, I will try to upload a few of the above profiles with mostly mechanical fixes for usrmerge.

For example, re: rmix -> that's not something I can comment on, or would be comfortable changing myself.

snapd forked to https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1784394

This bug was fixed in the package isc-dhcp - 4.3.5-3ubuntu8

---------------
isc-dhcp (4.3.5-3ubuntu8) cosmic; urgency=medium

  * Adjust apparmor profile for usrmerge. LP: #1784023

 -- Dimitri John Ledkov <email address hidden> Mon, 30 Jul 2018 14:30:57 +0100

This bug was fixed in the package man-db - 2.8.4-1ubuntu1

---------------
man-db (2.8.4-1ubuntu1) cosmic; urgency=medium

  * Adapt apparmor profile for usrmerge. LP: #1784023

 -- Dimitri John Ledkov <email address hidden> Mon, 30 Jul 2018 14:23:24 +0100

For the strongswan change I filed a bug with Debian, I don't see an immediate need to add Delta for this.
@xnox: If there are serious deadlines involved you can obviously push the change, otherwise I'd wait for the next merge.

This bug was fixed in the package apparmor - 2.12-4ubuntu7

---------------
apparmor (2.12-4ubuntu7) cosmic; urgency=medium

  * Cherry-pick upstream patch for usr-merge for useradd profile.
  * Update chromium-browser profile with latest from profiles project.
  * Fixes LP: #1784023

 -- Dimitri John Ledkov <email address hidden> Wed, 01 Aug 2018 15:20:51 +0100

FYI - the libvirt change is in git, just needs a few other things and tests to be complete for an upload.

This bug was fixed in the package libvirt - 4.6.0-2ubuntu1

---------------
libvirt (4.6.0-2ubuntu1) cosmic; urgency=medium

  * Merged with Debian unstable (LP: #1786957).
    Among many other new features and fixes this includes fixes
    for (LP: #1754871), Remaining changes:
    - Disable libssh2 support (universe dependency)
    - Disable firewalld support (universe dependency)
    - Set qemu-group to kvm (for compat with older ubuntu)
    - Additional apport package-hook
    - Autostart default bridged network (As upstream does, but not Debian).
      In addition to just enabling it our solution provides:
      + do not autostart if subnet is already taken (e.g. in guests).
      + iterate some alternative subnets before giving up
    - d/p/ubuntu/Allow-libvirt-group-to-access-the-socket.patch: This is
      the group based access to libvirt functions as it was used in Ubuntu
      for quite long.
      + d/p/ubuntu/daemon-augeas-fix-expected.patch fix some related tests
        due to the group access change.
      + d/libvirt-daemon-system.postinst: add users in sudo to the libvirt
        group.
    - ubuntu/parallel-shutdown.patch: set parallel shutdown by default.
    - d/p/ubuntu/enable-kvm-spice.patch: compat with older Ubuntu qemu/kvm
      which provided a separate kvm-spice.
    - Xen related
      - d/p/ubuntu/ubuntu-libxl-qemu-path.patch: this change was split. The
        section that adapts the path of the emulator to the Debian/Ubuntu
        packaging is kept.
      - d/p/ubuntu/ubuntu-libxl-Fix-up-VRAM-to-minimum-requirements.patch: auto
        set VRAM to minimum requirements
      - d/p/ubuntu/xen-default-uri.patch: set default URI on xen hosts
      - Add libxl log directory
      - libvirt-uri.sh: Automatically switch default libvirt URI for users on
        Xen dom0 via user profile (was missing on changelogs before)
    - d/p/ubuntu/apibuild-skip-libvirt-common.h: drop libvirt-common.h from
      included_files to avoid build failures due to duplicate definitions.
    - Update README.Debian with Ubuntu changes
    - Convert libvirt0, libnss_libvirt and libvirt-dev to multi-arch.
    - Enable some additional features on ppc64el and s390x (for arch parity)
      + systemtap, zfs, numa and numad on s390x.
      + systemtap on ppc64el.
    - d/t/control, d/t/smoke-qemu-session: fixup smoke-qemu-session by making
      vmlinuz available and accessible (Debian bug 848314)
    - d/t/control, d/t/smoke-lxc: fix up lxc smoke test isolation
    - Add dnsmasq configuration to work with system wide dnsmasq (drop >18.04,
      no more UCA onto Xenial then which has global dnsmasq by default).
    - d/p/ubuntu/ubuntu_machine_type.patch: accept ubuntu types as pci440fx
    - Further upstreamed apparmor Delta, especially any new one
      Our former delta is split into logical pieces and is either Ubuntu only
      or is part of a continuous upstreaming effort.
      Listing related remaining changes in debian/patches/ubuntu-aa/:
      + 0001-apparmor-Allow-pygrub-to-run-on-Debian-Ubuntu.patch: apparmor:
        Allow pygrub to run on Debian/Ubuntu
      + 0003-apparmor-libvirt-qemu-Allow-read-access-to-overcommi.patch:
        ...

This bug was fixed in the package lightdm-remote-session-x2go - 0.0.2.0-2ubuntu1

---------------
lightdm-remote-session-x2go (0.0.2.0-2ubuntu1) cosmic; urgency=medium

  * Add support for usr-merge in the apparmor profile. (LP: #1784023)

 -- Dimitri John Ledkov <email address hidden> Tue, 21 Aug 2018 00:35:03 +0100

This bug was fixed in the package lightdm-remote-session-freerdp2 - 2.0.0-1ubuntu1

---------------
lightdm-remote-session-freerdp2 (2.0.0-1ubuntu1) cosmic; urgency=medium

  * Add support for usr-merge in the apparmor profile. (LP: #1784023)

 -- Dimitri John Ledkov <email address hidden> Tue, 21 Aug 2018 00:37:17 +0100

This bug was fixed in the package telepathy-mission-control-5 - 1:5.16.4-2ubuntu2

---------------
telepathy-mission-control-5 (1:5.16.4-2ubuntu2) cosmic; urgency=medium

  * Add support for usr-merge in the apparmor profile. (LP: #1784023)

 -- Dimitri John Ledkov <email address hidden> Tue, 21 Aug 2018 00:48:49 +0100

This bug was fixed in the package strongswan - 5.6.2-2ubuntu2

---------------
strongswan (5.6.2-2ubuntu2) cosmic; urgency=medium

  * Add support for usr-merge, thanks to Christian Ehrhardt. LP: #1784023

 -- Dimitri John Ledkov <email address hidden> Tue, 21 Aug 2018 00:42:38 +0100

This bug was fixed in the package lightdm - 1.26.0-0ubuntu2

---------------
lightdm (1.26.0-0ubuntu2) cosmic; urgency=medium

  * Cherrypick upstream PR to add support for usr-merge in apparmor
    profile. LP: #1784023

 -- Dimitri John Ledkov <email address hidden> Tue, 21 Aug 2018 00:05:28 +0100

I took a look because this appeared on the Debian package tracker for apparmor-profiles-extra. At least 1.24 (just uploaded to sid) seems to be OK. I've not checked older versions so I don't know when exactly the problem that affected this package (which seems unspecified here) was fixed. If there's anything left to fix in this package, please let me know :)

Fixed in 2.0+git20181009-2.