fix(profile): small improvment raised by the tests.

apparmor.d/groups/_full/systemd

@@ -152,6 +152,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
   #aa:dbus own bus=system name=org.freedesktop.timesync1
 
   @{bin}/**                         Px,
+  @{sbin}/**                        Px,
   @{lib}/**                         Px,
   /etc/cron.*/*                     Px,
   /etc/init.d/*                     Px,

apparmor.d/groups/apt/deb-systemd-helper

@@ -16,14 +16,19 @@ profile deb-systemd-helper @{exec_path} {
 
   @{bin}/systemctl rCx -> systemctl,
 
-  /var/lib/systemd/deb-systemd-helper-enabled/** rw,
-  /var/lib/systemd/deb-systemd-helper-masked/ rw,
-  /var/lib/systemd/deb-systemd-user-helper-enabled/** rw,
+  /etc/systemd/system/* w,
+  /etc/systemd/user/* w,
+
+  /var/lib/systemd/deb-systemd-helper-enabled/{,**} rw,
+  /var/lib/systemd/deb-systemd-helper-masked/{,**} rw,
+  /var/lib/systemd/deb-systemd-user-helper-enabled/{,**} rw,
 
   profile systemctl {
     include <abstractions/base>
     include <abstractions/app/systemctl>
 
+    capability net_admin,
+
     /etc/ r,
     /etc/systemd/ r,
     /etc/systemd/system/ r,

apparmor.d/groups/bus/dbus-system

@@ -47,6 +47,7 @@ profile dbus-system flags=(attach_disconnected) {
   @{exec_path} mrix,
 
   @{bin}/**                   PUx,
+  @{sbin}/**                  PUx,
   @{lib}/**                   PUx,
   /usr/share/*/**             PUx,
 

apparmor.d/groups/network/rpcbind

@@ -6,7 +6,7 @@ abi <abi/4.0>,
 
 include <tunables/global>
 
-@{exec_path} = @{bin}/rpcbind
+@{exec_path} = @{sbin}/rpcbind
 profile rpcbind @{exec_path} flags=(complain) {
   include <abstractions/base>