feat(profiles): general update.

apparmor.d/groups/virt/cockpit-bridge

@@ -45,14 +45,15 @@ profile cockpit-bridge @{exec_path} {
   @{run}/user/@{uid}/ssh-agent.[0-9A-Z]* rw,
   @{run}/utmp r,
 
-  owner @{PROC}/@{pid}/cgroup r,
-  owner @{PROC}/@{pid}/fd/ r,
-  owner @{PROC}/@{pid}/mounts r,
         @{PROC}/@{pids}/net/dev r,
         @{PROC}/1/cgroup r,
         @{PROC}/cmdline r,
         @{PROC}/diskstats r,
+        @{PROC}/loadavg r,
         @{PROC}/uptime r,
+  owner @{PROC}/@{pid}/cgroup r,
+  owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/mounts r,
 
   /dev/ptmx rw,
 

apparmor.d/groups/virt/cockpit-pcp

@@ -28,6 +28,11 @@ profile cockpit-pcp @{exec_path} {
 
   /var/log/pcp/pmlogger/ r,
 
+  @{sys}/fs/cgroup/{,**/} r,
+  @{sys}/fs/cgroup/**/{memory,cpu}* r,
+  @{sys}/devices/platform/**/hwmon/hwmon[0-9]*/temp* r,
+  @{sys}/devices/platform/**/hwmon/hwmon[0-9]*/fan* r,
+
         @{PROC}/diskstats r,
         @{PROC}/swaps r,
   owner @{PROC}/@{pid}/mounts r,

apparmor.d/groups/virt/virtlogd

@@ -9,12 +9,12 @@ include <tunables/global>
 @{exec_path} = /{usr/,}{s,}bin/virtlogd
 profile virtlogd @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
-  include <abstractions/openssl>
   include <abstractions/nameservice-strict>
+  include <abstractions/openssl>
 
   ptrace (read) peer=libvirtd,
-  ptrace (read) peer=virtqemud,
   ptrace (read) peer=unconfined,
+  ptrace (read) peer=virtqemud,
 
   @{exec_path} mr,
 
@@ -29,17 +29,17 @@ profile virtlogd @{exec_path} flags=(attach_disconnected) {
   owner @{run}/user/@{uid}/libvirt/virtlogd* w,
 
   @{run}/libvirt/common/system.token rwk,
-  @{run}/systemd/inhibit/[0-9]*.ref rw,
   @{run}/libvirt/virtlogd-sock rw,
+  @{run}/systemd/inhibit/[0-9]*.ref rw,
   @{run}/virtlogd.pid rwk,
 
   @{sys}/devices/system/node/ r,
   @{sys}/devices/system/node/node[0-9]*/meminfo r,
 
-  owner @{PROC}/@{pid}/stat r,
         @{PROC}/1/environ r,
         @{PROC}/cmdline r,
         @{PROC}/sys/kernel/osrelease r,
+  owner @{PROC}/@{pid}/stat r,
 
   /dev/dri/ r,