update apparmor profiles

Signed-off-by: Alexandre Pujol <alexandre@pujol.io>

apparmor.d/profiles-m-r/mkinitramfs

@@ -79,6 +79,7 @@ profile mkinitramfs @{exec_path} {
 
         /boot/ r,
   owner /boot/initrd.img-*.new rw,
+  owner /boot/config-* r,
 
         /var/tmp/ r,
   owner /var/tmp/mkinitramfs_*/ rw,

apparmor.d/profiles-m-r/mkvmerge

@@ -36,6 +36,7 @@ include <tunables/global>
 @{mkvmerge_ext} += [sS][rR][tT]
 @{mkvmerge_ext} += [tT][xX][tT]
 @{mkvmerge_ext} += [sS][uU][bB]
+@{mkvmerge_ext} += [mM][kK][sS]
 
 @{exec_path} = /{usr/,}bin/mkvmerge
 profile mkvmerge @{exec_path} {

apparmor.d/profiles-m-r/mkvtoolnix-gui

@@ -36,6 +36,7 @@ include <tunables/global>
 @{mkvtoolnix_ext} += [sS][rR][tT]
 @{mkvtoolnix_ext} += [tT][xX][tT]
 @{mkvtoolnix_ext} += [sS][uU][bB]
+@{mkvtoolnix_ext} += [mM][kK][sS]
 
 @{exec_path} = /{usr/,}bin/mkvtoolnix-gui
 profile mkvtoolnix-gui @{exec_path} {

apparmor.d/profiles-m-r/mtr

@@ -0,0 +1,29 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/mtr
+profile mtr @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/gtk>
+  include <abstractions/fonts>
+  include <abstractions/fontconfig-cache-read>
+  include <abstractions/freedesktop.org>
+  include <abstractions/nameservice-strict>
+
+  network inet dgram,
+  network inet6 dgram,
+  network netlink raw,
+
+  signal (send) set=(term, kill) peer=mtr-packet,
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/mtr-packet rPx,
+
+  include if exists <local/mtr>
+}

apparmor.d/profiles-m-r/mtr-packet

@@ -0,0 +1,27 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/mtr-packet
+profile mtr-packet @{exec_path} {
+  include <abstractions/base>
+
+  capability net_raw,
+
+  network inet stream,
+  network inet6 stream,
+  network inet dgram,
+  network inet6 dgram,
+  network inet raw,
+  network inet6 raw,
+
+  signal (receive) set=(kill, term) peer=mtr,
+
+  @{exec_path} mr,
+
+  include if exists <local/mtr-packet>
+}