tty and pts are part of abstractions/consoles

2022-08-01 18:30:03 +02:00 · 2022-08-01 18:30:03 +02:00 · 005dec1a53
commit 005dec1a53
parent 7ee9644325
59 changed files with 58 additions and 65 deletions
--- a/apparmor.d/groups/apps/usr.lib.libreoffice.program.soffice.bin
+++ b/apparmor.d/groups/apps/usr.lib.libreoffice.program.soffice.bin
@ -81,6 +81,7 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp

  #include <abstractions/audio>
  #include <abstractions/bash>
+  #include <abstractions/consoles>
  #include <abstractions/cups-client>
  #include <abstractions/dbus>
  #include <abstractions/dbus-session>
@ -151,8 +152,6 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
  /usr/bin/kgpg                         rix,
  /usr/bin/kleopatra                    rix,

-  /dev/tty                              rw,
-
  /usr/lib{,32,64}/@{multiarch}/gstreamer???/gstreamer-???/gst-plugin-scanner   rmPUx,
  owner @{user_cache_dirs}/gstreamer-???/**                                 rw,
  unix peer=(addr=@/tmp/.ICE-unix/* label=unconfined),  #Gstreamer doesn't work without this
--- a/apparmor.d/groups/apt/apt-mark
+++ b/apparmor.d/groups/apt/apt-mark
@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/apt-mark
 profile apt-mark @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/apt-common>

  @{exec_path} mr,
@ -25,7 +26,5 @@ profile apt-mark @{exec_path} {
  /var/cache/apt/ r,
  /var/cache/apt/** rwk,

-  /dev/pts/[0-9]* rw,
-
  include if exists <local/apt-mark>
 }
--- a/apparmor.d/groups/bus/dbus-run-session
+++ b/apparmor.d/groups/bus/dbus-run-session
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/dbus-run-session
 profile dbus-run-session @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/dconf-write>

  signal (receive) set=(term, kill, hup) peer=gdm*,
@ -31,9 +32,6 @@ profile dbus-run-session @{exec_path} {

  owner @{PROC}/@{pid}/fd/ r,

-  # file_inherit
-  /dev/tty rw,
-  /dev/tty[0-9]* rw,

  include if exists <local/dbus-run-session>
 }
--- a/apparmor.d/groups/freedesktop/fc-cache
+++ b/apparmor.d/groups/freedesktop/fc-cache
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{snap/snapd/[0-9]*/,}{usr/,}bin/fc-cache{,-32,-v*}
 profile fc-cache @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/fonts>
  include <abstractions/fontconfig-cache-write>

--- a/apparmor.d/groups/freedesktop/plymouth
+++ b/apparmor.d/groups/freedesktop/plymouth
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/plymouth
 profile plymouth @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>

  unix (send, receive, connect) type=stream peer=(addr="@/org/freedesktop/plymouthd"),

--- a/apparmor.d/groups/freedesktop/xdg-mime
+++ b/apparmor.d/groups/freedesktop/xdg-mime
@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/xdg-mime
 profile xdg-mime @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/freedesktop.org>

  @{exec_path} r,
@ -47,7 +48,6 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) {
  @{sys}/devices/platform/**/hwmon/hwmon[0-9]*/fan* r,

  /dev/dri/card[0-9]* rw,
-  /dev/tty rw,

  # When xdg-mime is run as root, it wants to exec dbus-launch, and hence it creates the two
  # following root processes:
--- a/apparmor.d/groups/freedesktop/xdg-open
+++ b/apparmor.d/groups/freedesktop/xdg-open
@ -10,6 +10,7 @@ include <tunables/global>
 profile xdg-open @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/consoles>
+  include <abstractions/consoles>
  include <abstractions/app-launcher-user>

  @{exec_path} r,
@ -50,7 +51,6 @@ profile xdg-open @{exec_path} flags=(attach_disconnected) {

  # file_inherit
  /dev/dri/card[0-9]* rw,
-  /dev/tty rw,

  profile dbus {
    include <abstractions/base>
--- a/apparmor.d/groups/freedesktop/xkbcomp
+++ b/apparmor.d/groups/freedesktop/xkbcomp
@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/xkbcomp
 profile xkbcomp @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
+  include <abstractions/consoles>

  unix (connect, receive, send) type=stream peer=(addr="@/tmp/.X11-unix/X[0-9]*"),
  unix (send,receive) type=stream addr=none peer=(label=gnome-shell),
@ -32,7 +33,6 @@ profile xkbcomp @{exec_path} flags=(attach_disconnected) {
  owner /tmp/server-[0-9]*.xkm rwk,

  /dev/dri/card[0-9]* rw,
-  /dev/tty rw,
  /dev/tty[0-9]* rw,
  
  deny /dev/input/event[0-9]* rw,
--- a/apparmor.d/groups/freedesktop/xorg
+++ b/apparmor.d/groups/freedesktop/xorg
@ -13,6 +13,7 @@ include <tunables/global>
@{exec_path} += /{usr/,}lib/xorg/Xorg{,.wrap}
 profile xorg @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/dbus-strict>
  include <abstractions/fontconfig-cache-read>
  include <abstractions/fonts>
@ -131,7 +132,6 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
  /dev/input/event[0-9]* rw,
  /dev/shm/#[0-9]*[0-9] rw,
  /dev/shm/shmfd-* rw,
-  /dev/tty rw,
  /dev/tty[0-9]* rw,
  /dev/vga_arbiter rw,  # Graphic card modules

--- a/apparmor.d/groups/freedesktop/xwayland
+++ b/apparmor.d/groups/freedesktop/xwayland
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path}  = /{usr/,}bin/Xwayland
 profile xwayland @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/dri-common>
  include <abstractions/dri-enumerate>
  include <abstractions/mesa>
@ -41,7 +42,6 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
  owner @{PROC}/@{pids}/comm r,

  /dev/tty[0-9]* rw,
-  /dev/tty rw,

  include if exists <local/xwayland>
 }
--- a/apparmor.d/groups/gnome/gdm-session-worker
+++ b/apparmor.d/groups/gnome/gdm-session-worker
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{libexec}/gdm-session-worker
 profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/authentication>
  include <abstractions/dbus-session-strict>
  include <abstractions/dbus-strict>
@ -87,7 +88,6 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
        @{PROC}/1/limits r,
        @{PROC}/keys r,

-  /dev/tty rw,
  /dev/tty[0-9]* rw,

  include if exists <local/gdm-session-worker>
--- a/apparmor.d/groups/gnome/gdm-xsession
+++ b/apparmor.d/groups/gnome/gdm-xsession
@ -43,7 +43,6 @@ profile gdm-xsession @{exec_path} {
    /{usr/,}bin/dbus-update-activation-environment mr,

    # file_inherit
-    /dev/tty rw,
    /dev/tty[0-9]* rw,
    owner @{HOME}/.xsession-errors w,
  }
--- a/apparmor.d/groups/gnome/gjs-console
+++ b/apparmor.d/groups/gnome/gjs-console
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path}  = /{usr/,}bin/gjs-console
 profile gjs-console @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/dbus-session-strict>
  include <abstractions/dconf-write>
  include <abstractions/dri-common>
@ -58,7 +59,6 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
  owner @{PROC}/@{pid}/stat r,

  /dev/ r,
-  /dev/tty rw,
  /dev/tty[0-9]* rw,

  include if exists <local/gjs-console>
--- a/apparmor.d/groups/gnome/gnome-extensions-app
+++ b/apparmor.d/groups/gnome/gnome-extensions-app
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/gnome-extensions-app
 profile gnome-extensions-app @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>

  @{exec_path} mr,

@ -17,7 +18,6 @@ profile gnome-extensions-app @{exec_path} {

  /usr/share/terminfo/x/xterm-256color r,

-  /dev/tty rw,

  include if exists <local/gnome-extensions-app>
 }
--- a/apparmor.d/groups/gnome/gnome-session-binary
+++ b/apparmor.d/groups/gnome/gnome-session-binary
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{libexec}/gnome-session-binary
 profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/dbus-session-strict>
  include <abstractions/dbus-strict>
  include <abstractions/dconf-write>
@ -141,7 +142,6 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
        @{PROC}/@{pid}/cgroup r,
        @{PROC}/cmdline r,

-  /dev/tty rw,
  /dev/tty[0-9]* rw,

  include if exists <usr/gnome-session-binary.d>
--- a/apparmor.d/groups/gnome/gsd-xsettings
+++ b/apparmor.d/groups/gnome/gsd-xsettings
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = @{libexec}/gsd-xsettings
 profile gsd-xsettings @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/dbus-session-strict>
  include <abstractions/dbus-strict>
  include <abstractions/dconf-write>
@ -70,7 +71,6 @@ profile gsd-xsettings @{exec_path} {

  owner @{PROC}/@{pid}/fd/ r,

-  /dev/tty rw,
  /dev/tty[0-9]* rw,

  profile run-parts {
--- a/apparmor.d/groups/gnome/nautilus
+++ b/apparmor.d/groups/gnome/nautilus
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/nautilus
 profile nautilus @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/app-launcher-user>
  include <abstractions/dbus-strict>
  include <abstractions/dconf-write>
@ -61,7 +62,6 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
  owner @{PROC}/@{pid}/mountinfo r,
        @{PROC}/@{pids}/net/wireless r,

-  /dev/tty rw,
  /dev/dri/card[0-9]* rw,

  include if exists <local/nautilus>
--- a/apparmor.d/groups/network/mullvad-gui
+++ b/apparmor.d/groups/network/mullvad-gui
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = "/opt/Mullvad VPN/mullvad-gui"
 profile mullvad-gui @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/chromium-common>
  include <abstractions/dconf-write>
  include <abstractions/dri-common>
@ -69,7 +70,6 @@ profile mullvad-gui @{exec_path} {
  owner @{PROC}/@{pid}/task/@{tid}/status r,
  owner @{PROC}/@{pid}/uid_map w,

-  /dev/tty rw,

  include if exists <local/mullvad-gui>
 }
--- a/apparmor.d/groups/network/nm-openvpn-service
+++ b/apparmor.d/groups/network/nm-openvpn-service
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/nm-openvpn-service
 profile nm-openvpn-service @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/nameservice-strict>

  capability kill,
@ -27,7 +28,6 @@ profile nm-openvpn-service @{exec_path} {
  @{run}/NetworkManager/nm-openvpn-@{uuid} rw,

  /dev/net/tun rw,
-  /dev/tty rw,

  owner @{PROC}/@{pid}/fd/ r,

--- a/apparmor.d/groups/network/wg-quick
+++ b/apparmor.d/groups/network/wg-quick
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/wg-quick
 profile wg-quick @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>

  capability net_admin,

@ -39,7 +40,6 @@ profile wg-quick @{exec_path} {

  @{PROC}/sys/net/ipv4/conf/all/src_valid_mark w,

-  /dev/tty rw,

  # Force the use as root
  deny /{usr/,}bin/sudo x,
--- a/apparmor.d/groups/pacman/archlinux-java
+++ b/apparmor.d/groups/pacman/archlinux-java
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/archlinux-java
 profile archlinux-java @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>

  capability dac_read_search,

@ -25,7 +26,6 @@ profile archlinux-java @{exec_path} {
  /{usr/,}lib/jvm/default w,
  /{usr/,}lib/jvm/default-runtime w,

-  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/paccache
+++ b/apparmor.d/groups/pacman/paccache
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/paccache
 profile paccache @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/nameservice-strict>

  capability dac_read_search,
@ -35,7 +36,6 @@ profile paccache @{exec_path} {

  owner @{PROC}/@{pid}/fd/ r,

-  /dev/tty rw,

  include if exists <local/paccache>
 }
--- a/apparmor.d/groups/pacman/pacdiff
+++ b/apparmor.d/groups/pacman/pacdiff
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/pacdiff
 profile pacdiff @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
+  include <abstractions/consoles>

  capability dac_read_search,
  capability mknod,
@ -36,7 +37,6 @@ profile pacdiff @{exec_path} flags=(attach_disconnected) {
  /usr/{,**} r,
  /var/{,**} r,

-  /dev/tty rw,

  # Inherit Silencer
  deny /apparmor/.null rw,
--- a/apparmor.d/groups/pacman/pacman-hook-dconf
+++ b/apparmor.d/groups/pacman/pacman-hook-dconf
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/dconf-update
 profile pacman-hook-dconf @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>

  capability dac_read_search,

@ -20,7 +21,6 @@ profile pacman-hook-dconf @{exec_path} {

  /etc/dconf/db/{,**} rw,

-  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-depmod
+++ b/apparmor.d/groups/pacman/pacman-hook-depmod
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/depmod
 profile pacman-hook-depmod @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>

  capability dac_read_search,

@ -23,7 +24,6 @@ profile pacman-hook-depmod @{exec_path} {

  /usr/lib/modules/*/{,**} rw,

-  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-dkms
+++ b/apparmor.d/groups/pacman/pacman-hook-dkms
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/dkms
 profile pacman-hook-dkms @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>

  capability dac_read_search,
  capability mknod,
@ -27,7 +28,6 @@ profile pacman-hook-dkms @{exec_path} {

  /etc/dkms/{,*} r,

-  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-fontconfig
+++ b/apparmor.d/groups/pacman/pacman-hook-fontconfig
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/40-fontconfig-config
 profile pacman-hook-fontconfig @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>

  capability dac_read_search,

@ -21,7 +22,6 @@ profile pacman-hook-fontconfig @{exec_path} {
  /etc/fonts/conf.d/* rwl,
  /usr/share/fontconfig/conf.default/* r,

-  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-gio
+++ b/apparmor.d/groups/pacman/pacman-hook-gio
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/gio-querymodules
 profile pacman-hook-gio @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>

  capability dac_read_search,

@ -23,7 +24,6 @@ profile pacman-hook-gio @{exec_path} {

  /usr/lib/gio/modules/ rw,

-  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-gtk
+++ b/apparmor.d/groups/pacman/pacman-hook-gtk
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/gtk-update-icon-cache
 profile pacman-hook-gtk @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>

  capability dac_read_search,

@ -23,7 +24,6 @@ profile pacman-hook-gtk @{exec_path} {

  /usr/share/icons/{,**} rw,

-  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-install
+++ b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-install
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/mkinitcpio-install
 profile pacman-hook-mkinitcpio-install @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
+  include <abstractions/consoles>

  capability dac_read_search,
  capability mknod,
@ -32,7 +33,6 @@ profile pacman-hook-mkinitcpio-install @{exec_path} flags=(attach_disconnected)
  / r,
  owner /boot/vmlinuz-* rw,

-  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove
+++ b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/mkinitcpio-remove
 profile pacman-hook-mkinitcpio-remove @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>

  capability dac_read_search,
  capability mknod,
@ -28,7 +29,6 @@ profile pacman-hook-mkinitcpio-remove @{exec_path} {
  /boot/initramfs-*.img rw,
  /boot/initramfs-*-fallback.img rw,

-  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-perl
+++ b/apparmor.d/groups/pacman/pacman-hook-perl
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/detect-old-perl-modules.sh
 profile pacman-hook-perl @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>

  capability dac_read_search,
  capability mknod,
@ -23,7 +24,6 @@ profile pacman-hook-perl @{exec_path} {

  /{usr/,}lib/perl[0-9]*/{,**} r,

-  /dev/tty rw,

  # Inherit silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-systemd
+++ b/apparmor.d/groups/pacman/pacman-hook-systemd
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/systemd-hook
 profile pacman-hook-systemd @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>

  capability dac_read_search,

@ -29,7 +30,6 @@ profile pacman-hook-systemd @{exec_path} {

  /usr/ rw,

-  /dev/tty rw,

  # Inherit silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-key
+++ b/apparmor.d/groups/pacman/pacman-key
@ -10,6 +10,7 @@ include <tunables/global>
 profile pacman-key @{exec_path} {
  include <abstractions/base>
  include <abstractions/consoles>
+  include <abstractions/consoles>

  capability dac_read_search,
  capability mknod,
@ -35,7 +36,6 @@ profile pacman-key @{exec_path} {

  /etc/pacman.d/gnupg/gpg.conf r,

-  /dev/tty rw,

  profile gpg {
    include <abstractions/base>
--- a/apparmor.d/groups/systemd/systemd-analyze
+++ b/apparmor.d/groups/systemd/systemd-analyze
@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/systemd-analyze
 profile systemd-analyze @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/systemd-common>

  capability sys_resource,
@ -57,8 +58,5 @@ profile systemd-analyze @{exec_path} {
  owner @{PROC}/@{pid}/comm r,
        @{PROC}/swaps r,

-  /dev/tty rw,
-  /dev/pts/1 rw,
-
  include if exists <local/systemd-analyze>
 }
--- a/apparmor.d/groups/systemd/systemd-environment-d-generator
+++ b/apparmor.d/groups/systemd/systemd-environment-d-generator
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/user-environment-generators/*
 profile systemd-environment-d-generator @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/systemd-common>
  include <abstractions/nameservice-strict>

@ -24,7 +25,6 @@ profile systemd-environment-d-generator @{exec_path} {

  owner @{user_config_dirs}/environment.d/{,*.conf} r,

-  /dev/tty rw,

  include if exists <local/systemd-environment-d-generator>
 }
--- a/apparmor.d/groups/systemd/systemd-sleep
+++ b/apparmor.d/groups/systemd/systemd-sleep
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/systemd-sleep
 profile systemd-sleep @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/nameservice-strict>
  include <abstractions/systemd-common>

@ -29,7 +30,6 @@ profile systemd-sleep @{exec_path} {

  @{PROC}/driver/nvidia/suspend w,

-  /dev/tty rw,

  include if exists <local/systemd-sleep>
 }
--- a/apparmor.d/groups/virt/k3s
+++ b/apparmor.d/groups/virt/k3s
@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}{local/,}bin/k3s
 profile k3s @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/disks-read>
  include <abstractions/nameservice-strict>
  include <abstractions/ssl_certs>
@ -166,7 +167,6 @@ profile k3s @{exec_path} {
  @{sys}/module/apparmor/parameters/enabled r,

  /dev/kmsg r,
-  /dev/pts/[0-9]* rw,

  include if exists <local/k3s>
 }