Suspicious "Welcome Cener" update

[DeadlyOats]

I don't know how to print screen and past an image onto a drawing application the way you'd do it in Windows. So, I can't do that here. So, I'll try to describe it as best as I can.

I got a notification on my Taskbar for a new update (Little circle with an arrow pointing up with a blue dot). I clicked on it and it opened "Discover Updates."

There is an update for "Welcome Center."

I read the details about this update:

Release Notes:
==5.27.11-0ubuntu3.2==
* Properly address the apparmor profile issue by adding multiple
lines for the different architectures we want to support until
@multiarch is supported. This closes (LP: #2065915)
Scarlett Moore Fri, 12 Jul 2024 00:44:59 -0700

==5.27.11-0ubuntu3.2==
* Allow all apparmor following other profiles. (LP: #2065915)
Scarlett Moore Mon, 08 Jul 2024 19:20:52 +0100

I clicked on the "More Information" button.

It took me to a Welcome Center page that has to do with KDE

I scrolled down to "What's New," and it basically repeated what was in the quote bubble above. Then I scrolled to the bottom and it said this:

Permissions for Welcome Center

Full Access
Can access everything on the system.

Is this normal? Is it normal for an app update like this to be granted complete utter access like this?

[1fallen2]

Apparmor is a security feature, with what you have shown currently, I see no worries.
Mine is a bit aggressive:

apparmor module is loaded.
1669 profiles are loaded.
77 profiles are in enforce mode.
   /usr/lib/apache2/mpm-prefork/apache2
   /usr/lib/apache2/mpm-prefork/apache2//DEFAULT_URI
   /usr/lib/apache2/mpm-prefork/apache2//HANDLING_UNTRUSTED_INPUT
   /usr/lib/apache2/mpm-prefork/apache2//phpsysinfo
   apache2
   apache2//DEFAULT_URI
   apache2//HANDLING_UNTRUSTED_INPUT
   apache2//phpsysinfo
   appstreamcli//curl
   aspell-autobuildhash//frontend
   avahi-daemon
   claws-mail//gpg
   coredumpctl//gdb
   dnsmasq
   dnsmasq//libvirt_leaseshelper
   dovecot
   dovecot-anvil
   dovecot-auth
   dovecot-config
   dovecot-deliver
   dovecot-dict
   dovecot-director
   dovecot-doveadm-server
   dovecot-dovecot-auth
   dovecot-dovecot-lda
   dovecot-dovecot-lda//sendmail
   dovecot-imap
   dovecot-imap-login
   dovecot-lmtp
   dovecot-log
   dovecot-managesieve
   dovecot-managesieve-login
   dovecot-pop3
   dovecot-pop3-login
   dovecot-replicator
   dovecot-script-login
   dovecot-ssl-params
   dovecot-stats
   execute-dput//gpg
   firejail-default
   freetube//dbus
   gsmartcontrol
   gsmartcontrol//terminal
   identd
   klogd
   lsb_release
   mdnsd
   mount-nfs//systemctl
   nmbd
   nscd
   ntpd
   nvidia_modprobe
   nvidia_modprobe//kmod
   php-fpm
   ping
   rpi-imager//opencl_pocl_clang
   rpi-imager//opencl_pocl_ld
   samba-bgqd
   samba-dcerpcd
   samba-rpcd
   samba-rpcd-classic
   samba-rpcd-spoolss
   signal-desktop//dbus
   smbd
   smbldap-useradd
   smbldap-useradd///etc/init.d/nscd
   syslog-ng
   syslogd
   torbrowser_firefox
   torbrowser_firefox//opencl_pocl_clang
   torbrowser_firefox//opencl_pocl_ld
   torbrowser_tor
   traceroute
   winbindd
   zgrep
   zgrep//helper
   zgrep//sed
1592 profiles are in complain mode.
   /{,usr/}{,s}bin/atril-previewer
   DiscoverNotifier
   DiscoverNotifier//gpg
   ModemManager
   NetworkManager
   NetworkManager//systemctl
   YACReader
   YACReaderLibrary
   aa-enabled
   aa-enforce
   aa-log
   aa-notify
   aa-status
   aa-teardown
   aa-unconfined
   abook
   accounts-daemon
   acpi
   acpi-powerbtn
   acpi-powerbtn//bus
   acpi-powerbtn//fgconsole
   acpi-powerbtn//systemctl
   acpid
   adb
   adduser
   adequate
   adequate//frontend
   adequate//ldd
   adequate//pkg-config
   agetty
   akonadi_akonotes_resource
   akonadi_archivemail_agent
   akonadi_birthdays_resource
   akonadi_contacts_resource
   akonadi_control
   akonadi_followupreminder_agent
   akonadi_ical_resource
   akonadi_indexing_agent
   akonadi_maildir_resource
   akonadi_maildispatcher_agent
   akonadi_mailfilter_agent
   akonadi_mailmerge_agent
   akonadi_migration_agent
   akonadi_newmailnotifier_agent
   akonadi_notes_agent
   akonadi_sendlater_agent
   akonadi_unifiedmailbox_agent
   alacarte
   alsactl
   amixer
   anacron
   anacron//run-parts
   anyremote
   anyremote//imagemagic
   anyremote//killall
   anyremote//pgrep
   aplay
   apparmor.systemd
   apparmor_parser
   appstreamcli
   arandr
   arch-audit
   archivemount
   archivemount//fusermount
   archlinux-java
   archlinux-keyring-wkd-sync
   arduino
   arduino-builder
   arduino-ctags
   arduino//open
   aspell
   aspell-autobuildhash
   at
   at-spi2-registryd
   atd
   atftpd
   atool
   atril
   atrild
   auditctl
   auditd
   augenrules
   aurpublish
   aurpublish//gpg
   avahi-autoipd
   avahi-browse
   avahi-publish
   avahi-resolve
   avahi-set-host-name
   badblocks
   baloo
   baloorunner
   biosdecode
   birdtray
   blkdeactivate
   blkid
   blockdev
   blueman
   blueman-mechanism
   blueman-rfcomm-watcher
   bluemoon
   bluetoothctl
   bluetoothd
   bmon
   boltd
   bootctl
   borg
   borg//ccache
   borg//fusermount
   brave
   brave-crashpad-handler
   brave-sandbox
   brave-wrapper
   browserpass
   browserpass//gpg
   btop
   btrfs
   btrfs-convert
   btrfs-find-root
   btrfs-image
   btrfs-map-logical
   btrfs-select-super
   btrfstune
   busctl
   calibre
   cawbird
   cawbird//open
   cc-remote-login-helper
   cctk
   ccze
   cemu
   cert-sync
   cfdisk
   cgdisk
   cgrulesengd
   chage
   changestool
   changestool//gpg
   check-bios-nx
   check-bios-nx//kmod
   check-support-status
   check-support-status-hook
   check-support-status-hook//debconf-escape
   check-support-status-hook//frontend
   check-support-status-hook//runuser
   check-support-status//debconf-escape
   chfn
   child-dpkg
   child-dpkg-divert
   child-modprobe-nvidia
   child-modprobe-nvidia//kmod
   child-open
   child-open-browsers
   child-open-help
   child-open-strict
   child-pager
   child-systemctl
   chpasswd
   chrome
   chrome-crashpad-handler
   chrome-gnome-shell
   chrome-sandbox
   chrome-wrapper
   chromium
   chromium-crashpad-handler
   chromium-sandbox
   chromium-wrapper
   chronyd
   chsh
   claws-mail
   cmus
   cni-bandwidth
   cni-bridge
   cni-calico
   cni-firewall
   cni-flannel
   cni-host-local
   cni-loopback
   cni-portmap
   cni-tuning
   cni-xtables-nft
   cockpit-askpass
   cockpit-bridge
   cockpit-bridge//udevadm
   cockpit-certificate-ensure
   cockpit-certificate-helper
   cockpit-desktop
   cockpit-pcp
   cockpit-session
   cockpit-ssh
   cockpit-tls
   cockpit-update-motd
   cockpit-update-motd//systemctl
   cockpit-ws
   cockpit-wsinstance-factory
   code-extension-git-askpass
   code-extension-git-editor
   colord
   colord-session
   compton
   conky
   conky//browse
   console-setup
   containerd
   containerd-shim-runc-v2
   convertall
   coredumpctl
   cppw-cpgr
   cpuid
   cpupower
   cpupower//kmod
   cracklib-packer
   crda
   cron
   cron-anacron
   cron-apport
   cron-apt
   cron-apt-compat
   cron-apt-listbugs
   cron-apt-listbugs//prefclean
   cron-apt-show-versions
   cron-apt-xapian-index
   cron-aptitude
   cron-cracklib
   cron-debsums
   cron-debsums//tee
   cron-debtags
   cron-dlocate
   cron-etckeeper
   cron-exim4-base
   cron-ipset-autoban-save
   cron-logrotate
   cron-man-db
   cron-mlocate
   cron-ntp
   cron-plocate
   cron-popularity-contest
   cron-popularity-contest//gpg
   cron-popularity-contest//popcon-upload
   cron-popularity-contest//runuser
   cron-popularity-contest//savelog
   cron-sysstat
   cron//run-parts
   crontab
   crontab//editor
   cups-backend-beh
   cups-backend-bluetooth
   cups-backend-brf
   cups-backend-dnssd
   cups-backend-hp
   cups-backend-implicitclass
   cups-backend-ipp
   cups-backend-lpd
   cups-backend-mdns
   cups-backend-parallel
   cups-backend-pdf
   cups-backend-serial
   cups-backend-snmp
   cups-backend-socket
   cups-backend-usb
   cups-browsed
   cups-notifier-dbus
   cups-notifier-mailto
   cups-notifier-rss
   cups-pk-helper-mechanism
   cupsd
   czkawka-cli
   czkawka-gui
   czkawka-gui//open
   dbus-accessibility
   dbus-session
   dbus-system
   dconf
   dconf-editor
   dconf-service
   ddclient
   ddcutil
   deja-dup-monitor
   deltachat-desktop
   deltachat-desktop//open
   deluser
   deluser//mount
   desktop-file-install
   df
   dfc
   dhclient
   dhclient-script
   dhclient-script//run-parts
   dhcpcd
   dig
   dino
   dirmngr
   discord
   discord-chrome-sandbox
   dkms
   dkms-autoinstaller
   dkms-autoinstaller//run-parts
   dkms-autoinstaller//systemctl
   dkms//kmod
   dleyna-renderer-service
   dleyna-server-service
   dlocate
   dlocate//md5sum
   dmcrypt-get-device
   dmesg
   dmeventd
   dmidecode
   dmsetup
   dnscrypt-proxy
   docker-proxy
   dockerd
   dolphin
   downloadhelper
   dring
   drkonqi
   drkonqi-coredump-cleanup
   drkonqi-coredump-processor
   dropbox
   dumpcap
   dumpe2fs
   dunstctl
   dunstctl//bus
   dunstify
   e2fsck
   e2image
   e2scrub_all
   earlyoom
   edid-decode
   eject
   element-desktop
   elinks
   engrampa
   ephy-profile-migrator
   epiphany
   epiphany-search-provider
   epiphany-webapp-provider
   etckeeper
   etckeeper//gpg
   evince
   evince-previewer
   evince-thumbnailer
   evolution-addressbook-factory
   evolution-alarm-notify
   evolution-calendar-factory
   evolution-source-registry
   evolution-user-prompter
   execute-dcut
   execute-dput
   exiftool
   exim4
   exo-compose-mail
   exo-helper
   exo-open
   f3brew
   f3fix
   f3fix//udevadm
   f3probe
   f3read
   f3write
   fail2ban-client
   fail2ban-server
   fatlabel
   fatresize
   fatresize//udevadm
   fc-cache
   fc-list
   fdisk
   ffmpeg
   ffmpegthumbnailer
   ffplay
   ffprobe
   file-roller
   filecap
   filezilla
   findmnt
   firecfg
   firefox
   firefox-crashreporter
   firefox-glxtest
   firefox-kmozillahelper
   firefox-minidump-analyzer
   firefox-pingsender
   firefox-plugin-container
   firefox-vaapitest
   firewalld
   flameshot
   flatpak
   flatpak-app
   flatpak-oci-authenticator
   flatpak-portal
   flatpak-session-helper
   flatpak-system-helper
   flatpak-system-helper//gpg
   flatpak-validate-icon
   flatpak//fusermount
   flatpak//gpg
   foliate
   font-manager
   fping
   fprintd
   fractal
   freefall
   freetube
   fritzing
   frontend
   frontend//scripts
   fsck
   fsck.btrfs
   fsck.fat
   fstrim
   fuse-overlayfs
   fuseiso
   fuseiso//fusermount
   fusermount
   fwupd
   fwupd//gpg
   fwupdmgr
   fwupdmgr//bus
   gajim
   gajim//ccache
   gajim//gpg
   ganyremote
   ganyremote//killall
   ganyremote//pgrep
   gconfd
   gcr-prompter
   gcr-ssh-agent
   gdisk
   gdk-pixbuf-query-loaders
   gdm
   gdm-defaut
   gdm-generate-config
   gdm-generate-config//pgrep
   gdm-runtime-config
   gdm-session
   gdm-session-worker
   gdm-xsession
   gdm-xsession//dbus
   gdm-xsession//systemctl
   geoclue
   ghc-pkg
   gio-launch-desktop
   gio-querymodules
   git
   git//editor
   git//exec
   git//gpg
   git//ssh
   gitg
   gitstatusd
   gjs-console
   gkbd-keyboard-display
   glib-compile-resources
   glib-compile-schemas
   glib-pacrunner
   globaltime
   glxgears
   glxinfo
   gmenudbusmenuproxy
   gnome-boxes
   gnome-boxes//virsh
   gnome-browser-connector-host
   gnome-calculator
   gnome-calculator-search-provider
   gnome-calendar
   gnome-characters
   gnome-characters-backgroudservice
   gnome-clocks
   gnome-contacts
   gnome-contacts-search-provider
   gnome-control-center
   gnome-control-center-goa-helper
   gnome-control-center-goa-helper//bwrap
   gnome-control-center-print-renderer
   gnome-control-center-search-provider
   gnome-control-center//bwrap
   gnome-control-center//pkexec
   gnome-desktop-thumbnailers
   gnome-disk-image-mounter
   gnome-disks
   gnome-extension-ding
   gnome-extension-gsconnect
   gnome-extension-manager
   gnome-extensions-app
   gnome-firmware
   gnome-initial-setup
   gnome-keyring-daemon
   gnome-logs
   gnome-maps
   gnome-music
   gnome-photos-thumbnailer
   gnome-recipes
   gnome-remote-desktop-daemon
   gnome-session
   gnome-session-binary
   gnome-session-binary//open
   gnome-session-ctl
   gnome-session//flatpak
   gnome-shell
   gnome-shell-calendar-server
   gnome-shell-hotplug-sniffer
   gnome-shell-overrides-migration
   gnome-shell//open
   gnome-shell//shell
   gnome-software
   gnome-software//fusermount
   gnome-software//gpg
   gnome-system-monitor
   gnome-system-monitor//pkexec
   gnome-terminal-server
   gnome-text-editor
   gnome-tour
   gnome-tweaks
   gnome-weather
   goa-daemon
   goa-identity-service
   gpa
   gparted
   gparted//killall
   gparted//systemctl
   gparted//udevadm
   gpartedbin
   gpartedbin//mount
   gpartedbin//udevadm
   gpartedbin//umount
   gpasswd
   gpg
   gpg-agent
   gpg-connect-agent
   gpgconf
   gpgsm
   gping
   gpo
   gpodder
   gpodder-migrate2tres
   gpu-manager
   groupadd
   groupdel
   groupmod
   groups
   grpck
   grub-bios-setup
   grub-check-signatures
   grub-editenv
   grub-file
   grub-fstest
   grub-glue-efi
   grub-install
   grub-kbdcomp
   grub-macbless
   grub-menulst2cfg
   grub-mkconfig
   grub-mkdevicemap
   grub-mkfont
   grub-mkimage
   grub-mklayout
   grub-mknetdir
   grub-mkpasswd-pbkdf2
   grub-mkrelpath
   grub-mkrescue
   grub-mkstandalone
   grub-mount
   grub-multi-install
   grub-ntldr-img
   grub-probe
   grub-reboot
   grub-render-label
   grub-script-check
   grub-set-default
   grub-sort-version
   grub-syslinux2cfg
   gsd-a11y-settings
   gsd-color
   gsd-datetime
   gsd-disk-utility-notify
   gsd-housekeeping
   gsd-keyboard
   gsd-media-keys
   gsd-power
   gsd-print-notifications
   gsd-printer
   gsd-rfkill
   gsd-screensaver-proxy
   gsd-sharing
   gsd-smartcard
   gsd-sound
   gsd-usb-protection
   gsd-wacom
   gsd-wwan
   gsd-xsettings
   gsd-xsettings//run-parts
   gsettings
   gsimplecal
   gsmartcontrol-root
   gsmartcontrol//bus
   gssproxy
   gtk-query-immodules
   gtk-update-icon-cache
   gtk-youtube-viewer
   gtk-youtube-viewer//open
   gtk-youtube-viewer//xterm
   gvfs-afc-volume-monitor
   gvfs-goa-volume-monitor
   gvfs-gphoto2-volume-monitor
   gvfs-mtp-volume-monitor
   gvfs-udisks2-volume-monitor
   gvfsd
   gvfsd-admin
   gvfsd-afc
   gvfsd-afp
   gvfsd-afp-browse
   gvfsd-archive
   gvfsd-burn
   gvfsd-cdda
   gvfsd-computer
   gvfsd-dav
   gvfsd-dnssd
   gvfsd-ftp
   gvfsd-fuse
   gvfsd-fuse//fusermount
   gvfsd-google
   gvfsd-gphoto2
   gvfsd-http
   gvfsd-localtest
   gvfsd-metadata
   gvfsd-mtp
   gvfsd-network
   gvfsd-nfs
   gvfsd-recent
   gvfsd-sftp
   gvfsd-smb
   gvfsd-smb-browse
   gvfsd-trash
   gvfsd-wsdd
   hardinfo
   hardinfo//ccache
   hardinfo//javac
   hardinfo//kmod
   hardinfo//open
   haveged
   hbbr
   hbbs
   hciconfig
   hddtemp
   hdparm
   hexchat
   highlight
   homebank
   host
   hostname
   hostnamectl
   htop
   hugeadm
   hugo
   hw-probe
   hw-probe//journalctl
   hw-probe//killall
   hw-probe//netconfig
   hw-probe//pacman
   hw-probe//rpm
   hw-probe//systemctl
   hw-probe//udevadm
   hwinfo
   hwinfo//kmod
   hwinfo//udevadm
   hypnotix
   hyprctl
   hyprland
   hyprlock
   hyprpaper
   hyprpicker
   hyprpm
   i2cdetect
   i3lock
   i3lock-fancy
   i3lock-fancy//imagemagic
   ibus-daemon
   ibus-dconf
   ibus-engine-simple
   ibus-engine-table
   ibus-extension-gtk3
   ibus-memconf
   ibus-portal
   ibus-x11
   iceauth
   id
   ifconfig
   ifup
   ifup//kmod
   ifup//run-parts
   ifup//sysctl
   iio-sensor-proxy
   im-launch
   img2txt
   imv
   initd-kexec
   initd-kexec-load
   initd-kexec-load//run-parts
   initd-kexec-load//systemctl
   initd-kexec//run-parts
   initd-kexec//systemctl
   initd-kmod
   initd-kmod//run-parts
   initd-kmod//systemctl
   install-catalog
   install-info
   install-printerdriver
   inxi
   inxi//ip
   inxi//kmod
   inxi//systemctl
   inxi//systemd
   inxi//udevadm
   ioping
   iotop
   ip
   ipcalc
   irqbalance
   issue-generator
   iw
   iwconfig
   iwctl
   iwd
   iwlist
   jackdbus
   jami-gnome
   jdownloader
   jdownloader//open
   jekyll
   jgmenu
   jitterentropy-rngd
   jmtpfs
   jmtpfs//fusermount
   journalctl
   k3s
   kaccess
   kactivitymanagerd
   kalendarac
   kanyremote
   kanyremote//killall
   kanyremote//pgrep
   kauth-backlighthelper
   kauth-chargethresholdhelper
   kauth-discretegpuhelper
   kauth-fontinst
   kauth-kded-smart-helper
   kauth-kinfocenter-dmidecode-helper
   kbuildsycoca
   kcheckpass
   kcminit
   kconf_update
   kconfig-hardened-check
   kde-powerdevil
   kde-systemd-start-condition
   kded
   kded//pgrep
   keepassxc
   keepassxc-cli
   keepassxc-proxy
   kernel-install
   kernel-install//kmod
   kerneloops
   kerneloops-applet
   kexec
   keyboxd
   kglobalacceld
   kgx
   kio_http_cache_cleaner
   kiod
   kioworker
   kmod
   kodi
   kodi-xrandr
   konsole
   kreadconfig
   kscreen_backend_launcher
   kscreen_osd_service
   kscreenlocker_greet
   ksmserver
   ksmserver-logout-greeter
   ksplashqml
   kstart
   kubernetes-pause
   kvm-ok
   kvm-ok//kmod
   kwalletd
   kwalletd//gpg
   kwalletmanager
   kwin_wayland
   kwin_wayland_wrapper
   kwin_x11
   labwc
   landscape-sysinfo
   landscape-sysinfo.wrapper
   language-validate
   last
   lastlog
   libreoffice
   libvirt-dbus
   libvirtd
   libvirtd//qemu_bridge_helper
   light
   light-locker
   light-locker-command
   lightdm
   lightdm-gtk-greeter
   lightdm-gtk-greeter//systemd
   lightdm-xsession
   lightdm-xsession//dbus
   lightdm-xsession//systemctl
   lightworks
   lightworks-ntcardvt
   linux-check-removal
   linux-check-removal//frontend
   linux-version
   linuxqq
   locale-gen
   localectl
   localepurge
   login
   loginctl
   logrotate
   logrotate//pgrep
   logrotate//systemctl
   losetup
   loupe
   loupe//bwrap
   low-memory-monitor
   lsblk
   lscpu
   lsinitramfs
   lspci
   lsusb
   lvm
   lvmconfig
   lvmdump
   lvmpolld
   lxappearance
   lxappearance//bus
   lynx
   macchanger
   makepkg
   makepkg//gpg
   makepkg//sudo
   mandb
   mate-notification-daemon
   mdevctl
   mediainfo
   mediainfo-gui
   mediainfo-gui//open
   megasync
   memtester
   merkaartor
   metadata-cleaner
   metadata-cleaner//bwrap
   mimetype
   minitube
   mission-control
   mke2fs
   mkfs-btrfs
   mkfs-fat
   mkinitcpio
   mkinitramfs
   mkinitramfs//find
   mkinitramfs//kmod
   mkinitramfs//ldconfig
   mkinitramfs//ldd
   mkntfs
   mkswap
   mkvmerge
   mkvtoolnix-gui
   mlocate
   modprobed-db
   molly-guard
   molly-guard//systemctl
   monitorix
   mono-sgen
   mount
   mount-cifs
   mount-nfs
   mount-zfs
   mousepad
   mpd
   mpsyt
   mpv
   msedge
   msedge-crashpad-handler
   msedge-sandbox
   msedge-wrapper
   mtools
   mtr
   mtr-packet
   mullvad-daemon
   mullvad-gui
   mullvad-setup
   multipath
   multipathd
   mumble
   mumble-overlay
   murmurd
   mutt
   mutt//editor
   mutt//gpg
   mutt//html-renderer
   mutt//pager
   mutter-x11-frames
   nautilus
   needrestart
   needrestart-apt-pinvoke
   needrestart-dpkg-status
   needrestart-iucode-scan-versions
   needrestart//systemctl
   nemo
   netcap
   nethogs
   netplan.script
   netplan.script//systemctl
   netplan.script//udevadm
   netstat
   networkctl
   networkd-dispatcher
   newgidmap
   newgrp
   newuidmap
   nfsdcld
   nft
   nm-daemon-helper
   nm-dhcp-helper
   nm-dispatcher
   nm-dispatcher//invoke-rc
   nm-dispatcher//run-parts
   nm-dispatcher//systemctl
   nm-iface-helper
   nm-initrd-generator
   nm-online
   nm-openvpn-auth-dialog
   nm-openvpn-service
   nm-openvpn-service-openvpn-helper
   nm-priv-helper
   nmap
   nmcli
   nologin
   nslookup
   ntfs-3g
   ntfs-3g-probe
   ntfscat
   ntfsclone
   ntfscluster
   ntfscmp
   ntfscp
   ntfsdecrypt
   ntfsfallocate
   ntfsfix
   ntfsinfo
   ntfslabel
   ntfsls
   ntfsmove
   ntfsrecover
   ntfsresize
   ntfssecaudit
   ntfstruncate
   ntfsundelete
   ntfsusermap
   ntfswipe
   nullmailer-send
   numlockx
   nvidia-detector
   nvidia-persistenced
   nvidia-settings
   nvidia-smi
   nvtop
   obamenu
   obconf
   obex-folder-listing
   obexautofs
   obexautofs//fusermount
   obexctl
   obexd
   obexfs
   obexfs//fusermount
   obexpush-atd
   obexpushd
   obxprop
   odt2txt
   okular
   okular//gpg
   ollama
   on-ac-power
   onefetch
   openbox
   openbox-session
   openbox//autostart
   openvpn
   openvpn//force-user-traffic-via-vpn
   openvpn//update-resolv
   opera
   opera-crashreporter
   opera-sandbox
   orage
   orage//open
   org.gnome.NautilusPreviewer
   os-prober
   ouch
   paccache
   pacdiff
   packagekitd
   packagekitd//gpg
   pacman
   pacman-conf
   pacman-hook-code
   pacman-hook-dconf
   pacman-hook-depmod
   pacman-hook-dkms
   pacman-hook-fontconfig
   pacman-hook-gio
   pacman-hook-gtk
   pacman-hook-gtk4-querymodules
   pacman-hook-mkinitcpio
   pacman-hook-mkinitcpio-remove
   pacman-hook-mkinitcpio//pacman
   pacman-hook-perl
   pacman-hook-systemd
   pacman-hook-systemd//systemctl
   pacman-key
   pacman-key//gpg
   pacman//gpg
   pacman//systemctl
   pacmd
   pactl
   pagesize
   pam-auth-update
   pam-auth-update//frontend
   pam-tmpdir-helper
   pam_kwallet_init
   parted
   parted//udevadm
   partprobe
   partprobe//udevadm
   pass
   pass-import
   pass//editor
   pass//git
   pass//gpg
   pass//pkill
   pass//qdbus
   passimd
   passwd
   pavucontrol
   pcb-gtk
   pcscd
   pdftotext
   picom
   pidof
   pinentry
   pinentry-curses
   pinentry-gnome3
   pinentry-gtk-2
   pinentry-kwallet
   pinentry-kwallet//kwalletcli
   pinentry-qt
   pipewire
   pipewire-media-session
   pipewire-pulse
   pkcs11-register
   pkexec
   pkttyagent
   plank
   plasma-browser-integration-host
   plasma-emojier
   plasma_session
   plasma_waitforname
   plasmashell
   plocate
   plocate-build
   plymouth
   plymouth-set-default-theme
   plymouthd
   polkit-agent-helper
   polkit-gnome-authentication-agent
   polkit-kde-authentication-agent
   polkit-mate-authentication-agent
   polkitd
   popularity-contest
   power-profiles-daemon
   protonmail-bridge
   protonmail-bridge-core
   protonmail-bridge-core//pass
   ps
   ps-mem
   pscap
   psi
   psi-plus
   psi-plus//aplay
   psi//aplay
   pstree
   pulseaudio
   pulseeffects
   pwck
   qbittorrent
   qbittorrent-nox
   qbittorrent//python
   qdbus
   qemu-bridge-helper
   qemu-ga
   qnapi
   qpdfview
   qt5ct
   qtchooser
   qtox
   quiterss
   quiterss//open
   rdmsr
   reflector
   remmina
   repo
   repo//gpg
   reprepro
   reprepro//gpg
   resize2fs
   resolvconf
   rfkill
   ristretto
   rngd
   rpcbind
   rpi-imager
   rredtool
   rsyslogd
   rtkit-daemon
   rtkitctl
   run-parts
   run-parts//kernel
   run-parts//motd
   runuser
   rustdesk
   rustdesk-utils
   rustdesk//sudo
   rustdesk_pynput_service
   rustdesk_python
   rustdesk_shell
   s3fs
   s3fs//fusermount
   sanoid
   sbctl
   scdaemon
   scrcpy
   scrot
   sdcv
   sddm
   sddm-greeter
   sddm-xsession
   sddm-xsession//dbus
   sddm-xsession//gpg
   sddm-xsession//run-parts
   sddm//systemctl
   sddm//xauth
   seahorse
   secure-time-sync
   sensors
   sensors-detect
   sensors-detect//kmod
   sensors-detect//systemctl
   sensors-detect//udevadm
   session-desktop
   session-migration
   setpci
   setvtrgb
   sfdisk
   sftp-server
   sgdisk
   signal-desktop
   signal-desktop-chrome-sandbox
   sing-box
   slirp4netns
   smartctl
   smartd
   smbspool
   smplayer
   smtube
   smtube//open
   snap
   snap-bootstrap
   snap-device-helper
   snap-discard-ns
   snap-failure
   snap-failure//systemctl
   snap-repair
   snap-seccomp
   snap-update-ns
   snap//gpg
   snap//systemctl
   snapd
   snapd-aa-prompt-listener
   snapd-aa-prompt-ui
   snapd-apparmor
   snapd-core-fixup
   snapd//runuser
   snapshot
   socat
   spacefm-auth
   spectre-meltdown-checker
   spectre-meltdown-checker//ccache
   spectre-meltdown-checker//kmod
   spectre-meltdown-checker//mcedb
   spectre-meltdown-checker//pgrep
   speech-dispatcher
   speedtest
   spice-client-glib-usb-acl-helper
   spice-vdagent
   spice-vdagentd
   spotify
   ss
   ssh
   ssh-agent
   ssh-agent-launch
   ssh-agent-launch//dbus
   ssh-keygen
   sshd
   sshfs
   sshfs//fusermount
   sslocal
   ssmanager
   ssserver
   ssservice
   ssurl
   start-pulseaudio-x11
   startplasma
   startx
   startxfce
   startxfce//dbus
   startxfce//systemctl
   steam-runtime-steam-remote
   strawberry
   strawberry-tagreader
   su
   sudo
   sulogin
   superproductivity
   swaplabel
   swapon
   switcheroo-control
   switcherooctl
   swtpm
   swtpm_ioctl
   swtpm_localca
   swtpm_setup
   sync
   syncoid
   syncthing
   sysctl
   system-config-printer
   system-config-printer-applet
   systemd-ac-power
   systemd-analyze
   systemd-ask-password
   systemd-backlight
   systemd-binfmt
   systemd-cat
   systemd-cgls
   systemd-cgtop
   systemd-coredump
   systemd-cryptsetup
   systemd-delta
   systemd-detect-virt
   systemd-dissect
   systemd-escape
   systemd-fsck
   systemd-fsckd
   systemd-generator-bless-boot
   systemd-generator-cloud-init
   systemd-generator-cryptsetup
   systemd-generator-debug
   systemd-generator-ds-identify
   systemd-generator-environment-arch
   systemd-generator-environment-flatpak
   systemd-generator-fstab
   systemd-generator-getty
   systemd-generator-gpt-auto
   systemd-generator-hibernate-resume
   systemd-generator-integritysetup
   systemd-generator-ostree
   systemd-generator-run
   systemd-generator-system-update
   systemd-generator-user-autostart
   systemd-generator-user-environment
   systemd-generator-veritysetup
   systemd-homed
   systemd-homework
   systemd-hostnamed
   systemd-hwdb
   systemd-id128
   systemd-inhibit
   systemd-journald
   systemd-localed
   systemd-logind
   systemd-machine-id-setup
   systemd-machined
   systemd-makefs
   systemd-modules-load
   systemd-mount
   systemd-network-generator
   systemd-networkd
   systemd-networkd-wait-online
   systemd-notify
   systemd-oomd
   systemd-path
   systemd-portabled
   systemd-random-seed
   systemd-remount-fs
   systemd-resolve
   systemd-resolved
   systemd-rfkill
   systemd-shutdown
   systemd-sleep
   systemd-sleep-grub
   systemd-sleep-hdparm
   systemd-sleep-nvidia
   systemd-sleep-sysstat
   systemd-sleep-tlp
   systemd-sleep-upgrades
   systemd-socket-proxyd
   systemd-sulogin-shell
   systemd-sysctl
   systemd-sysusers
   systemd-timedated
   systemd-timesyncd
   systemd-tmpfiles
   systemd-tty-ask-password-agent
   systemd-udevd
   systemd-udevd//systemctl
   systemd-update-done
   systemd-update-utmp
   systemd-user-runtime-dir
   systemd-user-sessions
   systemd-userdbd
   systemd-userwork
   systemd-vconsole-setup
   systemsettings
   tailscale
   tailscaled
   tailscaled//systemctl
   task
   task//editor
   tasksel
   tasksel//frontend
   tasksel//tasksel-tests
   taskwarrior-tui
   telegram-desktop
   terminator
   tftp
   thermald
   thinkfan
   thunar
   thunar-volman
   thunar//dbus
   thunderbird
   thunderbird-glxtest
   thunderbird-vaapitest
   tint2
   tint2conf
   tomb
   tomb//umount
   top
   torbrowser
   torbrowser-glxtest
   torbrowser-launcher
   torbrowser-launcher//gpg
   torbrowser-plugin-container
   torbrowser-start
   torbrowser-tor
   torbrowser-updater
   torbrowser-vaapitest
   torify
   torsocks
   totem
   totem//bwrap
   tpacpi-bat
   tracker-extract
   tracker-miner
   tracker-writeback
   transmission
   tumblerd
   tune2fs
   udev-dmi-memory-id
   udiskie
   udiskie-info
   udiskie-mount
   udiskie-umount
   udiskie//open
   udisksctl
   udisksd
   udisksd//systemctl
   ufw
   umount
   umount.udisks2
   uname
   unhide-linux
   unhide-posix
   unhide-rb
   unhide-tcp
   unix-chkpwd
   unmkinitramfs
   update-alternatives
   update-ca-certificates
   update-ca-trust
   update-command-not-found
   update-cracklib
   update-desktop-database
   update-dlocatedb
   update-dlocatedb//updatedb
   update-grub
   update-initramfs
   update-mime-database
   update-pciids
   update-pciids//browse
   update-secureboot-policy
   update-smart-drivedb
   update-smart-drivedb//browse
   update-smart-drivedb//gpg
   updatedb-mlocate
   updatedb.plocate
   upower
   upowerd
   uptime
   uptimed
   usb-devices
   usbguard
   usbguard-applet-qt
   usbguard-daemon
   usbguard-dbus
   usbguard-notifier
   user_confined
   user_default
   user_unconfined
   useradd
   useradd//pam_tally2
   userdbctl
   userdel
   usermod
   users
   utempter
   utmpdump
   utox
   uuidd
   uuidgen
   uupdate
   vcsi
   veracrypt
   veracrypt//losetup
   veracrypt//umount
   vidcutter
   vipw-vigr
   vipw-vigr//editor
   virt-aa-helper
   virt-manager
   virtinterfaced
   virtiofsd
   virtlockd
   virtlogd
   virtnetworkd
   virtnodedevd
   virtsecretd
   virtstoraged
   vlc
   vlc-cache-gen
   vnstat
   vnstatd
   volumeicon
   vsftpd
   w
   w3m
   wavemon
   waybar
   wayland-session
   wemeet
   wg
   wg-quick
   whatis
   whdd
   whereis
   which
   whiptail
   who
   whoami
   wireplumber
   wireshark
   wl-copy
   wmctrl
   wpa-action
   wpa-cli
   wpa-gui
   wpa-supplicant
   wrmsr
   wsdd
   x11-xsession
   x11-xsession//dbus
   x11-xsession//gpg
   x11-xsession//run-parts
   x11-xsession//ssh-agent
   x11-xsession//udevadm
   xarchiver
   xarchiver//open
   xauth
   xautolock
   xbacklight
   xbrlapi
   xclip
   xdg-dbus-proxy
   xdg-desktop-icon
   xdg-desktop-menu
   xdg-desktop-portal
   xdg-desktop-portal-gnome
   xdg-desktop-portal-gtk
   xdg-desktop-portal-hyprland
   xdg-desktop-portal-kde
   xdg-desktop-portal-rewrite-launchers
   xdg-document-portal
   xdg-document-portal//fusermount
   xdg-email
   xdg-icon-resource
   xdg-mime
   xdg-mime//dbus
   xdg-open
   xdg-open//dbus
   xdg-permission-store
   xdg-screensaver
   xdg-settings
   xdg-settings//dbus
   xdg-user-dir
   xdg-user-dirs-gtk-update
   xdg-user-dirs-update
   xdm-xsession
   xdm-xsession//dbus
   xdm-xsession//systemctl
   xdpyinfo
   xembedsniproxy
   xfce-about
   xfce-appfinder
   xfce-clipman-settings
   xfce-dict
   xfce-mime-helper
   xfce-notifyd
   xfce-panel
   xfce-panel//root
   xfce-power-manager
   xfce-screensaver
   xfce-sensors
   xfce-session
   xfce-session//dbus
   xfce-session//systemctl
   xfce-terminal
   xfconfd
   xfdesktop
   xfpm-power-backlight-helper
   xfsettingsd
   xfwm
   xhost
   xinit
   xinit//run-parts
   xinit//udevadm
   xinput
   xkbcomp
   xorg
   xprop
   xrandr
   xrdb
   xsel
   xset
   xsetroot
   xsettingsd
   xwayland
   xwaylandvideobridge
   yadifad
   yay
   yay//editor
   yay//git
   yay//gpg
   yay//sudo
   yelp
   youtube-dl
   youtube-viewer
   youtube-viewer//wget
   yt-dlp
   ytdl
   zathura
   zed
   zenmap
   zfs
   zpool
   zram-generator
   zramctl
   zsys-system-autosnapshot
   zsysd
0 profiles are in kill mode.
0 profiles are in unconfined mode.
4 processes have profiles defined.
0 processes are in enforce mode.
4 processes are in complain mode.
   /usr/bin/aa-status (64246) aa-status
   /usr/bin/sudo (64242) sudo
   /usr/bin/sudo (64245) sudo
   /usr/lib/systemd/systemd-userwork (63717) systemd-userwork
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.
0 processes are in kill mode.

[DeadlyOats]

Apparmor is a security feature, with what you have shown currently, I see no worries.

Apparmor? I thought I was showing an update for Welcome Center, KDE Welcome Center.

[1fallen2]

You was indeed, but these are what you pointed to:

Release Notes:
==5.27.11-0ubuntu3.2==
* Properly address the apparmor profile issue by adding multiple
lines for the different architectures we want to support until 
@multiarch is supported.  This closes (LP: #2065915)
Scarlett Moore Fri, 12 Jul 2024 00:44:59 -0700

==5.27.11-0ubuntu3.2==
* Allow all apparmor following other profiles. (LP: #2065915)
Scarlett Moore Mon, 08 Jul 2024 19:20:52 +0100

And there is nothing there to be concerned about, Welcome Center pretty much had those permissions anyway it's just showing you what was fixed.