Update profiles.

apparmor.d/groups/pacman/mkinitcpio

@@ -55,9 +55,7 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) {
   /{usr/,}bin/modprobe            rPx,
 
   /{usr/,}lib/initcpio/busybox    rix,
-  /{usr/,}lib/ld-*.so             rix,
-  /{usr/,}@{multiarch}/ld-*.so    rix,
-  /{usr/,}lib/@{multiarch}/ld-*.so  rix,
+  /{usr/,}lib{,32,64}/ld-*.so     rix,
 
   /etc/fstab r,
   /etc/lvm/lvm.conf r,

apparmor.d/groups/pacman/pacman

@@ -48,13 +48,16 @@ profile pacman @{exec_path} {
   /{usr/,}bin/cat                         rix,
   /{usr/,}bin/dot                         rix,
   /{usr/,}bin/env                         rix,
+  /{usr/,}bin/gettext                     rix,
   /{usr/,}bin/ghc-pkg-*                   rix,
+  /{usr/,}bin/grep                        rix,
   /{usr/,}bin/rm                          rix,
   /{usr/,}bin/setcap                      rix,
   /{usr/,}bin/vercmp                      rix,
   /{usr/,}bin/xmlcatalog                  rix,
   /{usr/,}lib/ghc-*/bin/ghc-pkg           rix,
   /{usr/,}bin/arch-audit                  rPx,
+  /{usr/,}bin/archlinux-java              rPx,
   /{usr/,}bin/bootctl                     rPx,
   /{usr/,}bin/fc-cache                    rPx,
   /{usr/,}bin/gdk-pixbuf-query-loaders    rPx,
@@ -78,6 +81,7 @@ profile pacman @{exec_path} {
 
   # Install/update packages
   / r,
+  /*/ rwl,
   /boot/{,**} rwl,
   /etc/{,**} rwl,
   /opt/{,**} rwl,
@@ -85,12 +89,6 @@ profile pacman @{exec_path} {
   /usr/{,**} rwlk,
   /var/{,**} rwlk,
 
-  /bin/ rwl,
-  /home/ rw,
-  /lib/ rwl,
-  /lib64/ rwl,
-  /sbin/ rwl,
-
   @{PROC}/ r,
   @{run}/ r,
   @{sys}/{,**} r,
@@ -113,8 +111,7 @@ profile pacman @{exec_path} {
 
   # Silencer, 
   deny /tmp/ r,
-  deny @{HOME}/ r,
-  deny @{HOME}/@{XDG_PROJECTS_DIR}/** r,
+  deny @{HOME}/{,**} r,
 
   profile gpg {
     include <abstractions/base>

apparmor.d/groups/pacman/pacman-conf

@@ -17,6 +17,7 @@ profile pacman-conf @{exec_path} flags=(attach_disconnected) {
 
   /etc/pacman.conf r,
   /etc/pacman.d/mirrorlist r,
+  /etc/pacman.d/*-mirrorlist r,
 
   include if exists <local/pacman-conf>
 }

apparmor.d/groups/pacman/pacman-key

@@ -10,27 +10,49 @@ include <tunables/global>
 profile pacman-key @{exec_path} {
   include <abstractions/base>
   
+  capability dac_read_search,
+  capability mknod,
+
   @{exec_path} mr,
 
   /{usr/,}bin/basename     rix,
+  /{usr/,}bin/bash         rix,
+  /{usr/,}bin/gawk         rix,
   /{usr/,}bin/gettext      rix,
   /{usr/,}bin/gpg          rCx -> gpg,
   /{usr/,}bin/grep         rix,
   /{usr/,}bin/pacman-conf  rPx,
   /{usr/,}bin/tput         rix,
+  /{usr/,}bin/wc           rix,
 
   /usr/share/makepkg/{,**} r,
   /usr/share/terminfo/x/xterm-256color r,
 
   /dev/tty rw,
 
+  # Inherit Silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
   profile gpg {
     include <abstractions/base>
 
-    /{usr/,}bin/gpg mr,
-  
+    capability dac_read_search,
+    capability mknod,
+
+    /{usr/,}bin/gpg        mr,
+    /{usr/,}bin/gpg-agent  mr,
+
+    /usr/share/pacman/keyrings/* r,
+
     /etc/pacman.d/gnupg/ rw,
     /etc/pacman.d/gnupg/** rwkl,
+
+    owner @{PROC}/@{pid}/fd/ r,
+
+    # Inherit Silencer
+    deny network inet6 stream,
+    deny network inet stream,
   }
 
   include if exists <local/pacman-key>