Consider allowing access to @{PROC}/@{pid}/limits

[Jacek Nykis]

I created snap for a monitoring system (prometheus) and it periodically wants to read /proc/<pid>/limits.

It would be good to allow read access to this file. I think it may be common for server software to try that access.

This line should do it:
@{PROC}/@{pid}/limits r,

$ snap --version
snap 2.11+0.16.04
snapd 2.11+0.16.04
series 16
ubuntu 16.04

[Jamie Strandboge (jdstrand)]

This is fine to add to the default apparmor template.

[Jamie Strandboge (jdstrand)]

This is the rule that should be used:

owner @{PROC}/@{pid}/limits r,

I can do it in my next batch of policy updates.

[Jamie Strandboge (jdstrand)]

2.20 fixes this issue.