Profiles update.

apparmor.d/groups/systemd/bootctl

@@ -12,6 +12,8 @@ profile bootctl @{exec_path} {
   include <abstractions/systemd-common>
   include <abstractions/disks-read>
 
+  capability mknod,
+
   signal (send) peer=child-pager,
 
   ptrace (read) peer=unconfined,

apparmor.d/groups/systemd/systemd-sleep

@@ -12,14 +12,23 @@ profile systemd-sleep @{exec_path} {
   include <abstractions/systemd-common>
 
   capability net_admin,
+  capability sys_admin,
   capability sys_resource,
 
   @{exec_path} mr,
 
+  /{usr/,}bin/{,ba,da}sh                   rix,
+  /{usr/,}bin/nvidia-sleep.sh              rix,
+  /{usr/,}lib/systemd/system-sleep/nvidia  rix,
+
   /etc/systemd/sleep.conf r,
   /etc/systemd/sleep.conf.d/{,*} r,
 
   @{sys}/power/state rw,
 
+  @{PROC}/driver/nvidia/suspend w,
+
+  /dev/tty rw,
+
   include if exists <local/systemd-sleep>
 }

apparmor.d/groups/systemd/systemd-udevd

@@ -1,6 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
-#               2021 Alexandre Pujol <alexandre@pujol.io>
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -92,6 +92,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
   owner @{PROC}/@{pid}/oom_score_adj rw,
   owner @{PROC}/@{pid}/fd/ r,
         @{PROC}/@{pids}/cgroup r,
+        @{PROC}/devices r,
         @{PROC}/sys/kernel/random/boot_id r,
 
   # file_inherit