Profiles update.

apparmor.d/groups/systemd/child-systemctl

@@ -13,7 +13,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 # Do not attach to /{usr/,}bin/systemctl by default
-profile child-systemctl {
+profile child-systemctl flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/wutmp>
@@ -38,5 +38,7 @@ profile child-systemctl {
 
   /dev/kmsg w,
 
+  deny /apparmor/.null rw,
+
   include if exists <local/child-systemctl>
 }