Profiles update.

apparmor.d/groups/apt/dpkg-divert

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2020-2021 Mikhail Morfikov
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -21,5 +22,7 @@ profile dpkg-divert @{exec_path} {
   /var/lib/dpkg/diversions-new rw,
   /var/lib/dpkg/diversions-old rwl -> /var/lib/dpkg/diversions,
 
+  /etc/** rw,
+
   include if exists <local/dpkg-divert>
 }

apparmor.d/groups/gnome/gnome-control-center

@@ -81,7 +81,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
   @{run}/udev/data/c13:[0-9]* r,    # for /dev/input/*
   @{run}/udev/data/c235:[0-9]* r,
   @{run}/udev/data/c236:[0-9]* r,
-  @{run}/udev/data/c510:[0-9]* r,
+  @{run}/udev/data/c51[0-9]:[0-9]* r,
   @{run}/udev/data/n[0-9]* r,
 
   @{sys}/bus/ r,
@@ -92,6 +92,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
   @{sys}/devices/virtual/**/uevent r,
   @{sys}/devices/pci[0-9]*/**/drm/ r,
   @{sys}/devices/virtual/dmi/id/chassis_type r,
+  @{sys}/devices/virtual/thermal/thermal_zone[0-9]/hwmon[0-9]/temp* r,
 
   owner @{sys}/fs/cgroup/user.slice/user-[0-9]*.slice/user@[0-9]*.service/{,**} rw,
 

apparmor.d/groups/gnome/gnome-session-binary

@@ -20,6 +20,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
   @{exec_path} mr,
 
   /{usr/,}bin/{,z,ba,da}sh                                 rix,
+  /{usr/,}bin/env                                          rix,
   /{usr/,}bin/xdg-user-dirs-gtk-update                     rix,
   /{usr/,}lib/gnome-session-check-accelerated              rix,
   /{usr/,}lib/gnome-session-check-accelerated-gl-helper    rix,
@@ -43,6 +44,8 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /usr/share/gnome-session/hardware-compatibility r,
   /usr/share/gnome-session/sessions/*.session r,
+  /usr/share/icons/{,**} r,
+  /usr/share/X11/xkb/{,**} r,
 
   /var/lib/gdm/.config/gnome-session/ rw,
   /var/lib/gdm/.config/gnome-session/saved-session/ rw,

apparmor.d/groups/pacman/mkinitcpio

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}bin/mkinitcpio
-profile mkinitcpio @{exec_path} {
+profile mkinitcpio @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
@@ -89,6 +89,7 @@ profile mkinitcpio @{exec_path} {
   deny @{HOME}/** r,
   deny network inet6 stream,
   deny network inet stream,
+  deny /apparmor/.null rw,
 
   include if exists <local/mkinitcpio>
 }

apparmor.d/groups/pacman/pacman

@@ -45,6 +45,7 @@ profile pacman @{exec_path} {
   # Pacman hooks & install scripts
   /{usr/,}{s,}bin/ldconfig                rix,
   /{usr/,}bin/{,ba}sh                     rix,
+  /{usr/,}bin/cat                         rix,
   /{usr/,}bin/dot                         rix,
   /{usr/,}bin/env                         rix,
   /{usr/,}bin/rm                          rix,

apparmor.d/groups/pacman/pacman-hook-gio

@@ -10,6 +10,8 @@ include <tunables/global>
 profile pacman-hook-gio @{exec_path} {
   include <abstractions/base>
 
+  capability dac_read_search,
+
   @{exec_path} mr,
 
   /{usr/,}bin/bash             rix,
@@ -19,6 +21,8 @@ profile pacman-hook-gio @{exec_path} {
   /{usr/,}lib/gio/modules/giomodule.cache{,.[0-9A-Z]*} rw,
   /{usr/,}lib/gtk-{3,4}.0/**/*/ rw,
 
+  /usr/lib/gio/modules/ rw,
+
   /dev/tty rw,
 
   # Inherit Silencer

apparmor.d/groups/systemd/child-systemctl

@@ -13,7 +13,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 # Do not attach to /{usr/,}bin/systemctl by default
-profile child-systemctl {
+profile child-systemctl flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/wutmp>
@@ -38,5 +38,7 @@ profile child-systemctl {
 
   /dev/kmsg w,
 
+  deny /apparmor/.null rw,
+
   include if exists <local/child-systemctl>
 }

apparmor.d/groups/systemd/systemd-hwdb

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}bin/systemd-hwdb
-profile systemd-hwdb @{exec_path} {
+profile systemd-hwdb @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
 
   @{exec_path} mr,
@@ -19,5 +19,7 @@ profile systemd-hwdb @{exec_path} {
 
   owner @{PROC}/@{pid}/stat r,
 
+  deny /apparmor/.null rw,
+
   include if exists <local/systemd-hwdb>
 }

apparmor.d/groups/systemd/systemd-journald

@@ -13,16 +13,14 @@ profile systemd-journald @{exec_path} {
   include <abstractions/consoles>
   include <abstractions/systemd-common>
 
-  capability syslog,
-  capability sys_ptrace,
+  capability audit_control,
   capability dac_read_search,
   capability kill,
-  capability sys_admin,
-  capability setuid,
   capability setgid,
-
-  # For audit logs
-  capability audit_control,
+  capability setuid,
+  capability sys_admin,
+  capability sys_ptrace,
+  capability syslog,
 
   network netlink raw,
 

apparmor.d/groups/systemd/systemd-sysusers

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}bin/systemd-sysusers
-profile systemd-sysusers @{exec_path} {
+profile systemd-sysusers @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
 
   @{exec_path} mr,
@@ -37,5 +37,7 @@ profile systemd-sysusers @{exec_path} {
   owner @{PROC}/@{pid}/stat r,
         @{PROC}/sys/kernel/random/boot_id r,
 
+  deny /apparmor/.null rw,
+
   include if exists <local/systemd-sysusers>
 }

apparmor.d/groups/systemd/systemd-tmpfiles

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}bin/systemd-tmpfiles
-profile systemd-tmpfiles @{exec_path} {
+profile systemd-tmpfiles @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/systemd-common>
   include <abstractions/nameservice-strict>
@@ -50,5 +50,7 @@ profile systemd-tmpfiles @{exec_path} {
 
   @{PROC}/@{pid}/net/unix r,
 
+  deny /apparmor/.null rw,
+
   include if exists <local/systemd-tmpfiles>
 }

apparmor.d/groups/systemd/systemd-udevd

@@ -97,5 +97,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
   # file_inherit
   owner @{HOME}/.xsession-errors w,
 
+  deny /apparmor/.null rw,
+
   include if exists <local/systemd-udevd>
 }

apparmor.d/groups/virt/libvirtd

@@ -84,22 +84,20 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
   / r,
   /** rwmkl,
 
-  /bin/* PUx,
-  /sbin/* PUx,
-  /usr/bin/* PUx,
+  /{usr/,}bin/* rPUx,
+  /{usr/,}sbin/* rPUx,
   /{usr/,}{,s}bin/virtlogd rPx,
-  /usr/sbin/* PUx,
-  /{usr/,}lib/udev/scsi_id PUx,
-  /usr/{lib,lib64}/xen-common/bin/xen-toolstack PUx,
-  /usr/{lib,lib64}/xen/bin/* Ux,
-  @{libexec}/xen-*/bin/libxl-save-helper PUx,
-  @{libexec}/xen-*/bin/pygrub PUx,
-  /usr/{lib,lib64,lib/qemu,libexec}/vhost-user-gpu PUx,
-  /usr/{lib,lib64,lib/qemu,libexec}/virtiofsd PUx,
+  /{usr/,}lib/udev/scsi_id rPUx,
+  /usr/{lib,lib64}/xen-common/bin/xen-toolstack rPUx,
+  /usr/{lib,lib64}/xen/bin/* rUx,
+  @{libexec}/xen-*/bin/libxl-save-helper rPUx,
+  @{libexec}/xen-*/bin/pygrub rPUx,
+  /usr/{lib,lib64,lib/qemu,libexec}/vhost-user-gpu rPUx,
+  /usr/{lib,lib64,lib/qemu,libexec}/virtiofsd rPUx,
 
   # Required by nwfilter_ebiptables_driver.c:ebiptablesWriteToTempFile() to
   # read and run an ebtables script.
-  /var/lib/libvirt/virtd* ixr,
+  /var/lib/libvirt/virtd* rix,
 
   # force the use of virt-aa-helper
   audit deny /{usr/,}{s,}bin/apparmor_parser rwxl,
@@ -108,7 +106,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
   audit deny /sys/kernel/security/apparmor/matching rwxl,
   audit deny /sys/kernel/security/apparmor/.* rwxl,
   /sys/kernel/security/apparmor/profiles r,
-  /usr/lib/libvirt/* PUxr,
+  /usr/lib/libvirt/* rPUx,
   /usr/lib/libvirt/libvirt_parthelper ix,
   /usr/lib/libvirt/libvirt_iohelper ix,
   /etc/libvirt/hooks/** rmix,