FM / sbin

/snap/core18/2999/usr/sbin

Name	Size	Mode	Actions
aa-remove-unknown	2923	0755	edit dl rm
aa-status	8610	0755	edit dl rm
add-shell	860	0755	edit dl rm
addgroup	37322	0755	edit dl rm
adduser	37322	0755	edit dl rm
apparmor_status	8610	0755	edit dl rm
arpd	55328	0755	edit dl rm
chgpasswd	59216	0755	edit dl rm
chmem	43088	0755	edit dl rm
chpasswd	55152	0755	edit dl rm
chroot	39096	0755	edit dl rm
cpgr	57304	0755	edit dl rm
cppw	57304	0755	edit dl rm
delgroup	16495	0755	edit dl rm
deluser	16495	0755	edit dl rm
e2freefrag	14408	0755	edit dl rm
e4crypt	22600	0755	edit dl rm
e4defrag	26616	0755	edit dl rm
faillock	14328	0755	edit dl rm
fdformat	30800	0755	edit dl rm
filefrag	14352	0755	edit dl rm
genl	59448	0755	edit dl rm
groupadd	63408	0755	edit dl rm
groupdel	72056	0755	edit dl rm
groupmems	59256	0755	edit dl rm
groupmod	69816	0755	edit dl rm
grpck	55096	0755	edit dl rm
grpconv	50872	0755	edit dl rm
grpunconv	50872	0755	edit dl rm
iconvconfig	30976	0755	edit dl rm
invoke-rc.d	16031	0755	edit dl rm
ip6tables-apply	7016	0755	edit dl rm
iptables-apply	7016	0755	edit dl rm
ldattach	30800	0755	edit dl rm
mklost+found	10232	0755	edit dl rm
netplan	798	0755	edit dl rm
newusers	84368	0755	edit dl rm
nfnl_osf	14328	0755	edit dl rm
nologin	6136	0755	edit dl rm
pam-auth-update	19850	0755	edit dl rm
pam_getenv	2890	0755	edit dl rm
pam_timestamp_check	10232	0755	edit dl rm
pwck	50992	0755	edit dl rm
pwconv	46800	0755	edit dl rm
pwunconv	46776	0755	edit dl rm
readprofile	18544	0755	edit dl rm
remove-shell	904	0755	edit dl rm
rfkill	47184	0755	edit dl rm
rmt	59792	0755	edit dl rm
rmt-tar	59792	0755	edit dl rm
rtcwake	43088	0755	edit dl rm
service	9262	0755	edit dl rm
sshd	790952	0755	edit dl rm
tarcat	936	0755	edit dl rm
tzconfig	106	0755	edit dl rm
update-ca-certificates	5394	0755	edit dl rm
update-mime	9053	0755	edit dl rm
update-passwd	31136	0755	edit dl rm
update-rc.d	16508	0755	edit dl rm
useradd	126240	0755	edit dl rm
userdel	84464	0755	edit dl rm
usermod	126016	0755	edit dl rm
vigr	61624	0755	edit dl rm
vipw	61624	0755	edit dl rm
visudo	213816	0755	edit dl rm
zic	55440	0755	edit dl rm

Edit: /snap/core18/2999/usr/sbin/aa-remove-unknown (2923B)

#!/bin/sh
# ----------------------------------------------------------------------
#    Copyright (c) 2017 Canonical Ltd. (All rights reserved)
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program. If not, see <http://www.gnu.org/licenses/>.
# ----------------------------------------------------------------------

APPARMOR_FUNCTIONS=/lib/apparmor/functions
APPARMORFS=/sys/kernel/security/apparmor
PROFILES_IFACE="${APPARMORFS}/profiles"
REMOVE="${APPARMORFS}/.remove"

DRY_RUN=0

. $APPARMOR_FUNCTIONS

usage() {
	local progname="$1"
	local rc="$2"
	local msg="usage: ${progname} [options]

Remove profiles unknown to the system

Options:
 -h, --help	Show this help message and exit
 -n		Dry run; don't remove profiles"

if [ "$rc" -ne 0 ] ; then
		echo "$msg" 1>&2
	else
		echo "$msg"
	fi

exit "$rc"
}

if [ "$#" -gt 1 ] ; then
	usage "$0" 1
elif [ "$#" -eq 1 ] ; then
	if [ "$1" = "-h" -o "$1" = "--help" ] ; then
		usage "$0" 0
	elif [ "$1" = "-n" ] ; then
		DRY_RUN=1
	else
		usage "$0" 1
	fi
fi

# We can't use a -r test here because while $PROFILES_IFACE is world-readable,
# apparmorfs may still return EACCES from open()
#
# We have to do this check because error checking awk's getline() below is
# tricky and, as is, results in an infinite loop when apparmorfs returns an
# error from open().
if ! IFS= read line < "$PROFILES_IFACE" ; then
	echo "ERROR: Unable to read apparmorfs profiles file" 1>&2
	exit 1
elif [ ! -w "$REMOVE" ] ; then
	echo "ERROR: Unable to write to apparmorfs remove file" 1>&2
	exit 1
fi

# Clean out running profiles not associated with the current profile
# set, excluding the libvirt dynamically generated profiles.
aa_configured=$(mktemp -t aa-XXXXXX)
configured_profile_names > "$aa_configured"
if [ "$?" -ne 0 ] ; then
	echo "ERROR: Unable to enumerate the known profiles" 1>&2
	rm -f "$aa_configured" "$aa_loaded"
	exit 1
fi

aa_loaded=$(mktemp -t aa-XXXXXX)
running_profile_names > "$aa_loaded" || true
if [ "$?" -ne 0 ] ; then
	echo "ERROR: Unable to enumerate the running profiles" 1>&2
	rm -f "$aa_configured" "$aa_loaded"
	exit 1
fi

LC_COLLATE=C comm -2 -3 "$aa_loaded" "$aa_configured" | while read profile ; do
	if [ "$DRY_RUN" -ne 0 ]; then
		echo "Would remove '${profile}'"
	else
		echo "Removing '${profile}'"
		unload_profile "$profile"
	fi
done
ret="$?"

rm -f "$aa_configured" "$aa_loaded"

# will not catch all errors, but still better than nothing
exit $ret

cmd: