* etc/apparmor.d/guix-daemon (guix-builder)[/tmp/**]:
  Allow database locks and file operations.

Fixes: https://codeberg.org/guix/guix/issues/8363
Merges: https://codeberg.org/guix/guix/pulls/10017
Tested-by: Owen T. Heisler <writer@owenh.net>
Signed-off-by: Nguyễn Gia Phong <cnx@loang.net>

Currently Guix daemon would always fail to build packages that require
execution of programs and scripts in "/tmp" directory (e.g. in "bootstrap"
phase) on foreign distributions that use AppArmor as it denies such requests
due to policy restrictions.  This patch fixes "guix-daemon" AppArmor policy by
allowing execution of programs in "/tmp" for "guix-builder".

See <https://codeberg.org/guix/guix/issues/6501>

* etc/apparmor.d/guix-daemon: Fix permissions for guix-daemon/guix-builder.

Change-Id: Ib6a33fcc035011d7045da03346f3afeb598b7d7a
Signed-off-by: Efraim Flashner <efraim@flashner.co.il>

* etc/apparmor.d/guix,
etc/teams/release/artifacts-manifest.scm: Fix misspellings in comments.

Change-Id: Iff757784cc82968c25004bdb430f1ae3ad44624e

* etc/apparmor.d/guix: New file.
* Makefile.am (nodist_apparmor_profile_DATA): Add it.

Change-Id: I3d61238203d7663ce582717f8e4eac4c6f679928
Signed-off-by: Rutherther <rutherther@ditigal.xyz>

* .gitignore: Add etc/apparmor.d/tunables/guix.
* Makefile.am (nodist_apparmor_profile_DATA)
(nodist_apparmor_profile_tunables_DATA): Define it.
* configure.ac: Generate etc/apparmor.d/tunables/guix. Add
--with-apparmor-profile-dir option.
* etc/apparmor.d/guix-daemon: New file.
* etc/apparmor.d/tunables/guix.in: New file.
* doc/guix.texi: Document AppArmor profiles.
* gnu/packages/package-management.scm (guix): Add future changes commented.

Change-Id: Iac7df9d642383cc46a2d450c3badef31199ab041
Signed-off-by: Rutherther <rutherther@ditigal.xyz>