feat(profile): include more rule from #94.

apparmor.d/groups/grub/grub-mkconfig

@@ -25,6 +25,7 @@ profile grub-mkconfig @{exec_path} {
   /{usr/,}bin/{e,f,}grep           rix,
   /{usr/,}bin/{m,g,}awk            rix,
   /{usr/,}bin/basename             rix,
+  /{usr/,}bin/btrfs                rPx,
   /{usr/,}bin/cat                  rix,
   /{usr/,}bin/chmod                rix,
   /{usr/,}bin/cut                  rix,
@@ -62,6 +63,7 @@ profile grub-mkconfig @{exec_path} {
   /boot/grub/{**,} rw,
 
   /etc/default/grub r,
+  /etc/default/grub-btrfs/config r,
   /etc/default/grub.d/{*,} r,
 
   /usr/share/grub/{**,} r,

apparmor.d/groups/grub/grub-mkrelpath

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2022 Jeroen Rijken
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -11,9 +12,15 @@ profile grub-mkrelpath @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
 
+  capability sys_admin,
+
   @{exec_path} mr,
+
   /{usr/,}{local/,}{s,}bin/zpool rPx,
 
+  / r,
+  /usr/share/grub/* r,
+
   @{PROC}/@{pids}/mountinfo r,
 
   include if exists <local/grub-mkrelpath>

apparmor.d/groups/grub/grub-mount

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2022 Jeroen Rijken
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -10,9 +11,16 @@ include <tunables/global>
 profile grub-mount @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
+  include <abstractions/disks-read>
+
+  capability sys_admin,
 
   @{exec_path} mr,
 
+  / r,
+  /var/lib/os-prober/mount/ r,
+
+  /dev/fuse rw,
+
   include if exists <local/grub-mount>
 }
-

apparmor.d/groups/grub/grub-probe

@@ -23,6 +23,7 @@ profile grub-probe @{exec_path} {
   /{usr/,}bin/udevadm            rPx,
 
   / r,
+  /usr/share/grub/* r,
 
   @{PROC}/@{pids}/mountinfo r,
   @{PROC}/devices r,

apparmor.d/groups/grub/grub-script-check

@@ -13,7 +13,7 @@ profile grub-script-check @{exec_path} {
 
   @{exec_path} mr,
 
-  /boot/grub/grub.cfg{.new,} rw,
+  /boot/grub/grub* rw,
 
   include if exists <local/grub-script-check>
 }