feat(profiles): general update.

apparmor.d/groups/systemd/systemd-coredump

@@ -25,6 +25,8 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected,mediate_deleted
 
   mount -> /,
 
+  ptrace (read),
+
   @{exec_path} mr,
 
   @{lib}/** r,

apparmor.d/groups/systemd/systemd-journald

@@ -27,6 +27,8 @@ profile systemd-journald @{exec_path} {
 
   network netlink raw,
 
+  ptrace (read),
+
   @{exec_path} mr,
 
   /etc/systemd/journald.conf r,

apparmor.d/groups/systemd/systemd-portabled

@@ -13,16 +13,9 @@ profile systemd-portabled @{exec_path} {
 
   capability sys_ptrace,
 
-  ptrace (read) peer=unconfined,
-
   @{exec_path} mr,
 
   /var/lib/portables/{,**} rw,
 
-  @{PROC}/1/environ r,
-  @{PROC}/cmdline r,
-  @{PROC}/sys/kernel/osrelease r,
-  @{PROC}/sys/kernel/random/boot_id r,
-
   include if exists <local/systemd-portabled>
 }

apparmor.d/groups/systemd/systemd-tty-ask-password-agent

@@ -14,6 +14,7 @@ profile systemd-tty-ask-password-agent @{exec_path} {
 
   audit capability net_admin,
 
+  signal (receive) set=(term cont) peer=default,
   signal (receive) set=(term cont) peer=logrotate,
 
   @{exec_path} mr,