feat(profile): add more systemd-generator profiles.

apparmor.d/groups/systemd-generators/systemd-generator-environment-snapd

@@ -0,0 +1,18 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/systemd/system-environment-generators/snapd-env-generator
+profile systemd-generator-environment-snapd @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  include if exists <local/systemd-generator-environment-snapd>
+}
+
+# vim:syntax=apparmor

apparmor.d/groups/systemd-generators/systemd-generator-import

@@ -0,0 +1,31 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/systemd/system-generators/systemd-import-generator
+profile systemd-generator-import @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+
+  capability sys_ptrace,
+
+  ptrace read peer=@{p_systemd},
+
+  @{exec_path} mr,
+
+  @{PROC}/@{pid}/cgroup r,
+  @{PROC}/1/environ r,
+  @{PROC}/cmdline r,
+  @{PROC}/sys/kernel/osrelease r,
+
+  / r,
+
+  /dev/kmsg w,
+
+  include if exists <local/systemd-generator-import>
+}
+
+# vim:syntax=apparmor

apparmor.d/groups/systemd-generators/systemd-generator-openvpn

@@ -0,0 +1,27 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/systemd/system-generators/openvpn-generator
+profile systemd-generator-openvpn @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  @{sh_path}                               r,
+  @{bin}/ls                                ix,
+  @{bin}/mkdir                             ix,
+
+  /etc/default/openvpn r,
+  /etc/openvpn/ r,
+
+  @{run}/systemd/generator/openvpn.service.wants/{,**} w,
+
+  include if exists <local/systemd-generator-openvpn>
+}
+
+# vim:syntax=apparmor

apparmor.d/groups/systemd-generators/systemd-generator-ssh

@@ -0,0 +1,48 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/systemd/system-generators/systemd-ssh-generator
+profile systemd-generator-ssh @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+
+  capability net_admin,
+
+  network vsock stream,
+
+  ptrace read peer=@{p_systemd},
+
+  @{exec_path} mr,
+
+  @{sbin}/sshd r,
+
+  @{run}/ r,
+  @{run}/systemd/ r,
+  @{run}/systemd/generator/ r,
+  @{run}/systemd/generator/sockets.target.wants/ rw,
+  @{run}/systemd/generator/sockets.target.wants/*.socket w,
+  @{run}/systemd/generator/sshd-*.service w,
+  @{run}/systemd/generator/sshd-*.socket rw,
+  @{run}/systemd/system/ r,
+  @{run}/systemd/transient/ r,
+
+  @{sys}/devices/virtual/dmi/id/product_name r,
+  @{sys}/devices/virtual/dmi/id/sys_vendor r,
+
+  @{PROC}/@{pid}/cgroup r,
+  @{PROC}/1/cgroup r,
+  @{PROC}/1/environ r,
+  @{PROC}/cmdline r,
+  @{PROC}/sys/kernel/osrelease r,
+
+  /dev/kmsg w,
+  /dev/vsock r,
+
+  include if exists <local/systemd-generator-ssh>
+}
+
+# vim:syntax=apparmor

apparmor.d/groups/systemd-generators/systemd-generator-tpm2

@@ -0,0 +1,30 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/systemd/system-generators/systemd-tpm2-generator
+profile systemd-generator-tpm2 @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+
+  ptrace read peer=@{p_systemd},
+
+  @{exec_path} mr,
+
+  @{sys}/class/tpmrm/ r,
+
+  @{PROC}/@{pid}/cgroup r,
+  @{PROC}/1/cgroup r,
+  @{PROC}/1/environ r,
+  @{PROC}/cmdline r,
+  @{PROC}/sys/kernel/osrelease r,
+
+  /dev/kmsg w,
+
+  include if exists <local/systemd-generator-tpm2>
+}
+
+# vim:syntax=apparmor

dists/flags/main.flags

@@ -329,19 +329,24 @@ systemd-generator-debug attach_disconnected,complain
 systemd-generator-ds-identify attach_disconnected,complain
 systemd-generator-environment-arch complain
 systemd-generator-environment-flatpak complain
+systemd-generator-environment-snapd attach_disconnected,complain
 systemd-generator-friendly-recover attach_disconnected,complain
 systemd-generator-fstab attach_disconnected,complain
 systemd-generator-getty attach_disconnected,complain
 systemd-generator-gpt-auto attach_disconnected,complain
 systemd-generator-hibernate-resume attach_disconnected,complain
+systemd-generator-import attach_disconnected,complain
 systemd-generator-integritysetup attach_disconnected,complain
+systemd-generator-openvpn attach_disconnected,complain
 systemd-generator-ostree attach_disconnected,complain
 systemd-generator-rc-local attach_disconnected,complain
 systemd-generator-run attach_disconnected,complain
 systemd-generator-snapd attach_disconnected,complain
+systemd-generator-ssh attach_disconnected,complain
 systemd-generator-sshd-socket attach_disconnected,complain
 systemd-generator-system-update attach_disconnected,complain
 systemd-generator-sysv attach_disconnected,complain
+systemd-generator-tpm2 attach_disconnected,complain
 systemd-generator-user-autostart attach_disconnected,complain
 systemd-generator-user-environment attach_disconnected,complain
 systemd-generator-veritysetup attach_disconnected,complain
@@ -350,8 +355,8 @@ systemd-homework complain
 systemd-inhibit attach_disconnected,complain
 systemd-journald attach_disconnected,mediate_deleted
 systemd-mount complain
-systemd-network-generator complain
+systemd-network-generator attach_disconnected,complain
-systemd-nsresourced complain
+systemd-nsresourced attach_disconnected,complain
 systemd-nsresourcework complain
 systemd-portabled complain
 systemd-resolve complain