feat(profiles): general update.

apparmor.d/groups/systemd/journalctl

@@ -49,6 +49,8 @@ profile journalctl @{exec_path} flags=(attach_disconnected) {
 
   deny @{user_share_dirs}/gvfs-metadata/* r,
   deny /apparmor/.null rw,
+  deny network inet stream,
+  deny network inet6 stream,
 
   include if exists <local/systemd-journalctl>
 }

apparmor.d/groups/systemd/loginctl

@@ -12,14 +12,8 @@ profile loginctl @{exec_path} {
   include <abstractions/dbus-strict>
   include <abstractions/systemd-common>
 
-  capability sys_resource,
   capability net_admin,
-
-  @{exec_path} mr,
-
-  /{usr/,}bin/less  rPx -> child-pager,
-  /{usr/,}bin/more  rPx -> child-pager,
-  /{usr/,}bin/pager rPx -> child-pager,
+  capability sys_resource,
 
   dbus (send) bus=system path=/org/freedesktop/login[0-9]*
        interface=org.freedesktop.login[0-9]*.Manager
@@ -31,5 +25,11 @@ profile loginctl @{exec_path} {
        member={Get,GetAll}
        peer=(name=org.freedesktop.login[0-9]*, label=systemd-logind),
 
+  @{exec_path} mr,
+
+  /{usr/,}bin/less  rPx -> child-pager,
+  /{usr/,}bin/more  rPx -> child-pager,
+  /{usr/,}bin/pager rPx -> child-pager,
+
   include if exists <local/loginctl>
 }

apparmor.d/groups/systemd/systemd-coredump

@@ -8,7 +8,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path}  = /{usr/,}lib/systemd/systemd-coredump
-profile systemd-coredump @{exec_path} flags=(attach_disconnected) {
+profile systemd-coredump @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
   include <abstractions/openssl>

apparmor.d/groups/systemd/systemd-hostnamed

@@ -49,12 +49,9 @@ profile systemd-hostnamed @{exec_path}  flags=(attach_disconnected) {
   @{run}/systemd/notify rw,
   @{run}/udev/data/+dmi:id r,
 
-  @{sys}/devices/virtual/dmi/id/bios_vendor r,
-  @{sys}/devices/virtual/dmi/id/bios_version r,
-  @{sys}/devices/virtual/dmi/id/board_vendor r,
-  @{sys}/devices/virtual/dmi/id/chassis_type r,
-  @{sys}/devices/virtual/dmi/id/product_name r,
-  @{sys}/devices/virtual/dmi/id/product_version r,
+  @{sys}/devices/virtual/dmi/id/ r,
+  @{sys}/devices/virtual/dmi/id/{bios_vendor,bios_version,board_vendor,bios_date} r,
+  @{sys}/devices/virtual/dmi/id/{product_name,product_version,chassis_type} r,
   @{sys}/devices/virtual/dmi/id/sys_vendor r,
   @{sys}/devices/virtual/dmi/id/uevent r,
   @{sys}/firmware/dmi/entries/*/raw r,

apparmor.d/groups/systemd/systemd-networkd

@@ -72,6 +72,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected,complain) {
   @{run}/udev/data/n[0-9]* r,
 
   @{sys}/devices/**/net/** r,
+  @{sys}/devices/pci[0-9]*/**/ r,
   @{sys}/devices/virtual/dmi/id/{sys,board,bios}_vendor r,
   @{sys}/devices/virtual/dmi/id/product_name r,
 

apparmor.d/groups/systemd/systemd-resolved

@@ -56,7 +56,7 @@ profile systemd-resolved @{exec_path} flags=(attach_disconnected) {
   owner @{run}/systemd/journal/socket w,
 
   @{PROC}/sys/kernel/hostname r,
-  @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
+  @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r,
 
   include if exists <local/systemd-timesyncd>
 }