[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

---

Description of your pull request and other information

Ubuntu 25.04+ confine /usr/bin/tshark with an AppArmor profile that reads only /tmp and /usr/share/wireshark, so PyShark tests on ubuntu-26.04 fail with TSharkCrashException retcode 3.

• New step "Let tshark read the checkout past its AppArmor profile" after the tshark install in engine-tests (PyShark cell only) and pypcap-parity (shared with pypcap-parity-ktlo by anchor; KTLO-guarded). When /etc/apparmor.d/tshark exists it appends file r ${GITHUB_WORKSPACE}/**, to local/tshark and runs apparmor_parser -r; a no-op on 24.04.
• Rule form per apparmor.d(5) FILE RULE ([file] ACCESS FILEGLOB), the form upstream's profiles/apparmor.d/tshark uses; the parser follows include if exists and folds included files into its cache-staleness check (parser_lex.l, update_mru_tstamp).
• tests/project/test_tshark_apparmor_2019.py pins placement/body and runs the script against a scratch /etc/apparmor.d; 7 of 8 fail on main.
• Docs: AppArmor note under PyShark's requirements; the unit-tests.yml line citations the pins check are shifted.

Not verified on a real 26.04 runner: this host has no tshark or AppArmor.

Closes #2019

[JarryShaw]

GOOD TO GO at ebe8a06cd.

A Sonnet cross-review confirmed:

• Profile: in upstream AppArmor's profiles/apparmor.d/tshark (checked at master, not the resolute tag), include if exists <local/tshark> sits inside the top-level tshark profile, ahead of the dumpcap child. file r <glob>, is the profile's own form, and ${GITHUB_WORKSPACE} is expanded by the shell before it is written. tshark -r reads the file itself, so the dumpcap child is not on the path.
• Coverage: all three tshark installs get the step: engine-tests (PyShark), pypcap-parity, and pypcap-parity-ktlo through the *pypcap-parity-steps anchor.
• Tests: without the change the new test gives 10 failed. On the head, the new test plus test_unit_tests_queue.py give 48 passed.
• Citations: spot-checks confirm the +33 citation shift.

Not verified:

• whether a 26.04 runner reads the captures after the reload;
• whether apparmor_parser -r invalidates the cache.

Nit: the docs note says reads are allowed only under /tmp, but /usr/share/wireshark is allowed too.

[JarryShaw]

The fix is verified on a real Ubuntu 26.04 runner. On this head, Engines (PyShark), parity 3.11 and parity 3.10 (KTLO) all ran on ubuntu-26.04 and passed. Each one ran the apparmor_parser reload, logged no "permission to read" error, and had no failed tests. On #2006 the same jobs failed on that image.

The one red check, Project tests, fails because of #2020: the same three timeout tests fail the same way on main d419d8c39. This PR does not change them.

[github-actions]

Coverage: 91.55% (unit tier, Python 3.15, ebe8a06cd, Unit Tests run failure)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19597	881	2618	867	92.11%
pcapkit/corekit	2567	71	816	37	96.57%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	2930	23	1022	25	98.79%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17436	219	4582	185	98.15%
pcapkit/toolkit	872	36	298	10	95.21%
pcapkit/utilities	523	2	158	4	99.12%
pcapkit/vendor	4431	1995	1018	167	51.73%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

On PRs the "Plain unittest ordering" job is skipped, since it runs only on main. So I ran its project leg myself, the same way CI does (python util/run_unittest_leg.py project), on main d419d8c39 with #2021 and #2022 both merged in. Result: Ran 1675 tests ... OK (skipped=71). Both PRs' new modules ran and passed: test_tshark_apparmor_2019 and test_gnu_timeout_2020.

This host has GNU timeout. The uutils behaviour on 26.04 is covered instead by #2022's own Project tests job, which passed on a real ubuntu-26.04 runner.