feat(profile): general update.

apparmor.d/profiles-s-z/sensors-detect

@@ -1,6 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2020-2022 Mikhail Morfikov
-# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -14,49 +14,42 @@ profile sensors-detect @{exec_path} {
 
   capability syslog,
 
-  @{exec_path} r,
-  @{bin}/perl r,
-
-  /usr/bin/uname   rix,
-
-  /usr/bin/udevadm rCx -> udevadm,
-  /usr/bin/kmod    rCx -> kmod,
+  @{exec_path} rm,
+ 
+  @{bin}/kmod       rCx -> kmod,
+  @{bin}/perl         r,
+  @{bin}/systemctl  rPx -> child-systemctl,
+  @{bin}/udevadm    rCx -> udevadm,
+  @{bin}/uname      rix,
 
   /etc/udev/udev.conf r,
 
   @{sys}/bus/pci/devices/ r,
   @{sys}/class/i2c-adapter/ r,
-
   @{sys}/devices/@{pci}/{class,vendor,device} r,
-  @{sys}/devices/@{pci}/i2c-[0-9]*/name r,
+  @{sys}/devices/@{pci}/i2c-@{int}/name r,
   @{sys}/devices/@{pci}/modalias r,
   @{sys}/devices/virtual/dmi/id/board_{version,vendor,name} r,
-  @{sys}/devices/virtual/dmi/id/product_{version,name} r,
   @{sys}/devices/virtual/dmi/id/chassis_type r,
+  @{sys}/devices/virtual/dmi/id/product_{version,name} r,
   @{sys}/devices/virtual/dmi/id/sys_vendor r,
 
-  /dev/i2c-[0-9]* r,
-
+        @{PROC}/modules r,
   owner @{PROC}/@{pid}/mounts r,
-  @{PROC}/modules r,
 
+  /dev/i2c-@{int} r,
 
   profile udevadm {
     include <abstractions/base>
+    include <abstractions/systemd-common>
 
     capability sys_ptrace,
 
-    ptrace (read),
-
     @{bin}/udevadm mr,
 
     /etc/udev/udev.conf r,
 
-    owner @{PROC}/@{pid}/stat r,
-    owner @{PROC}/@{pid}/cgroup r,
-          @{PROC}/1/cgroup r,
-          @{PROC}/sys/kernel/random/boot_id r,
-
+    include if exists <local/sensors-detect_udevadm>
   }
 
   profile kmod {
@@ -64,13 +57,12 @@ profile sensors-detect @{exec_path} {
 
     @{bin}/kmod mr,
 
+    @{lib}/modprobe.d/{,*.conf} r,
+    /etc/modprobe.d/{,*.conf} r,
+
     @{PROC}/cmdline r,
 
-    @{lib}/modprobe.d/ r,
-    @{lib}/modprobe.d/*.conf r,
-    /etc/modprobe.d/ r,
-    /etc/modprobe.d/*.conf r,
-
+    include if exists <local/sensors-detect_udevadm>
   }
 
   include if exists <local/sensors-detect>

apparmor.d/profiles-s-z/setpci

@@ -9,11 +9,12 @@ include <tunables/global>
 @{exec_path} = @{bin}/setpci
 profile setpci @{exec_path} flags=(complain) {
   include <abstractions/base>
+  include <abstractions/consoles>
 
   @{exec_path} mr,
 
   @{sys}/bus/pci/devices/ r,
-  @{sys}/devices/pci[0-9]*/** r,
+  @{sys}/devices/@{pci}/** r,
 
   include if exists <local/setpci>
 }

apparmor.d/profiles-s-z/slirp4netns

@@ -27,7 +27,7 @@ profile slirp4netns @{exec_path} flags=(attach_disconnected) {
 
   pivot_root /tmp/**,
   pivot_root /tmp/old/,
-  # pivot_root oldroot=/tmp/old/ -> /tmp/, TODO: not supported on Debian
+  pivot_root oldroot=/tmp/old/ /tmp/,
 
   @{exec_path} mr,
 

apparmor.d/profiles-s-z/spotify

@@ -31,6 +31,8 @@ profile spotify @{exec_path} {
 
   @{exec_path} mrix,
 
+  @{bin}/grep rix,
+
   @{lib_dirs}/{,**} r,
   @{lib_dirs}/*.so* mr,
 
@@ -57,11 +59,15 @@ profile spotify @{exec_path} {
   owner @{run}/user/@{uid}/pulse/ r,
 
   @{sys}/devices/system/cpu/kernel_max r,
+  @{sys}/devices/virtual/dmi/id/board_{vendor,name,version} r,
+  @{sys}/devices/virtual/dmi/id/product_{name,version} r,
+  @{sys}/devices/virtual/dmi/id/sys_vendor r,
   @{sys}/devices/virtual/tty/tty@{int}/active r,
 
         @{PROC}/ r,
         @{PROC}/@{pid}/stat r,
         @{PROC}/sys/fs/inotify/max_user_watches r,
+  owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/oom_score_adj w,

apparmor.d/profiles-s-z/udisksd

@@ -50,6 +50,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
 
   # Allow mounting on temporary mount point
   mount -> @{run}/udisks2/temp-mount-*/,
+  mount / -> @{MOUNTS}/*/,
 
   # Allow unmounting
   umount @{MOUNTS}/,

apparmor.d/profiles-s-z/uname

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -7,7 +8,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = @{bin}/uname
-profile uname @{exec_path} {
+profile uname @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
 

apparmor.d/profiles-s-z/unix-chkpwd

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -9,9 +10,9 @@ include <tunables/global>
 @{exec_path} = @{bin}/unix_chkpwd
 profile unix-chkpwd @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
   include <abstractions/nameservice-strict>
 
-  # To write records to the kernel auditing log.
   capability audit_write,
 
   network netlink raw,
@@ -20,8 +21,5 @@ profile unix-chkpwd @{exec_path} {
 
   /etc/shadow r,
 
-  # file_inherit
-  owner /dev/tty@{int} rw,
-
   include if exists <local/unix-chkpwd>
 }

apparmor.d/profiles-s-z/which

@@ -8,7 +8,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = @{bin}/which{.debianutils,}
-profile which @{exec_path} {
+profile which @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
 
@@ -16,18 +16,14 @@ profile which @{exec_path} {
 
   @{bin}/{,ba,da}sh  rix,
 
-  @{bin}/{,*/} r,
+  @{bin}/ r,
+  @{bin}/**/ r,
   @{lib}/ r,
-  @{lib}/go-*/bin/ r,
-  /usr/{local/,}games/ r,
-  /usr/include/ r,
-  /usr/local/{,etc/,lib/} r,
-  /usr/local/{s,}bin/{,*/} r,
-
-  /opt/cni/bin/ r,
-  /opt/containerd/bin/ r,
-
+  @{lib}/**/ r,
+  /opt/**/bin/ r,
   /snap/bin/ r,
+  /usr/include/ r,
+  /usr/local/**/ r,
   /var/lib/flatpak/exports/bin/ r,
 
   owner @{HOME}/{.,}go/bin/ r,