feat(profile): add more systemd-generator profiles.

apparmor.d/groups/systemd-generators/systemd-generator-environment-snapd

@@ -0,0 +1,18 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/systemd/system-environment-generators/snapd-env-generator
+profile systemd-generator-environment-snapd @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  include if exists <local/systemd-generator-environment-snapd>
+}
+
+# vim:syntax=apparmor

apparmor.d/groups/systemd-generators/systemd-generator-import

@@ -0,0 +1,31 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/systemd/system-generators/systemd-import-generator
+profile systemd-generator-import @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+
+  capability sys_ptrace,
+
+  ptrace read peer=@{p_systemd},
+
+  @{exec_path} mr,
+
+  @{PROC}/@{pid}/cgroup r,
+  @{PROC}/1/environ r,
+  @{PROC}/cmdline r,
+  @{PROC}/sys/kernel/osrelease r,
+
+  / r,
+
+  /dev/kmsg w,
+
+  include if exists <local/systemd-generator-import>
+}
+
+# vim:syntax=apparmor

apparmor.d/groups/systemd-generators/systemd-generator-openvpn

@@ -0,0 +1,27 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/systemd/system-generators/openvpn-generator
+profile systemd-generator-openvpn @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  @{sh_path}                               r,
+  @{bin}/ls                                ix,
+  @{bin}/mkdir                             ix,
+
+  /etc/default/openvpn r,
+  /etc/openvpn/ r,
+
+  @{run}/systemd/generator/openvpn.service.wants/{,**} w,
+
+  include if exists <local/systemd-generator-openvpn>
+}
+
+# vim:syntax=apparmor

apparmor.d/groups/systemd-generators/systemd-generator-ssh

@@ -0,0 +1,48 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/systemd/system-generators/systemd-ssh-generator
+profile systemd-generator-ssh @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+
+  capability net_admin,
+
+  network vsock stream,
+
+  ptrace read peer=@{p_systemd},
+
+  @{exec_path} mr,
+
+  @{sbin}/sshd r,
+
+  @{run}/ r,
+  @{run}/systemd/ r,
+  @{run}/systemd/generator/ r,
+  @{run}/systemd/generator/sockets.target.wants/ rw,
+  @{run}/systemd/generator/sockets.target.wants/*.socket w,
+  @{run}/systemd/generator/sshd-*.service w,
+  @{run}/systemd/generator/sshd-*.socket rw,
+  @{run}/systemd/system/ r,
+  @{run}/systemd/transient/ r,
+
+  @{sys}/devices/virtual/dmi/id/product_name r,
+  @{sys}/devices/virtual/dmi/id/sys_vendor r,
+
+  @{PROC}/@{pid}/cgroup r,
+  @{PROC}/1/cgroup r,
+  @{PROC}/1/environ r,
+  @{PROC}/cmdline r,
+  @{PROC}/sys/kernel/osrelease r,
+
+  /dev/kmsg w,
+  /dev/vsock r,
+
+  include if exists <local/systemd-generator-ssh>
+}
+
+# vim:syntax=apparmor

apparmor.d/groups/systemd-generators/systemd-generator-tpm2

@@ -0,0 +1,30 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/systemd/system-generators/systemd-tpm2-generator
+profile systemd-generator-tpm2 @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+
+  ptrace read peer=@{p_systemd},
+
+  @{exec_path} mr,
+
+  @{sys}/class/tpmrm/ r,
+
+  @{PROC}/@{pid}/cgroup r,
+  @{PROC}/1/cgroup r,
+  @{PROC}/1/environ r,
+  @{PROC}/cmdline r,
+  @{PROC}/sys/kernel/osrelease r,
+
+  /dev/kmsg w,
+
+  include if exists <local/systemd-generator-tpm2>
+}
+
+# vim:syntax=apparmor