feat(profiles): general update.

apparmor.d/groups/systemd/systemd-hwdb

@@ -13,8 +13,8 @@ profile systemd-hwdb @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
-  /usr/lib/udev/.#hwdb.bin[0-9a-zA-Z]* w,
-  /usr/lib/udev/hwdb.bin w,
+  /{usr/,}lib/udev/.#hwdb.bin[0-9a-zA-Z]* w,
+  /{usr/,}lib/udev/hwdb.bin w,
 
   /etc/udev/hwdb.d/{,*} r,
 

apparmor.d/groups/systemd/systemd-rfkill

@@ -1,6 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2020-2021 Mikhail Morfikov
-#               2021 Alexandre Pujol <alexandre@pujol.io>
+# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -19,15 +19,14 @@ profile systemd-rfkill @{exec_path} {
 
   @{exec_path} mr,
 
-  /dev/rfkill rw,
-
-  @{sys}/devices/**/rfkill[0-9]*/{uevent,name} r,
-
   /var/lib/systemd/rfkill/* rw,
 
   @{run}/systemd/notify rw,
-
   @{run}/udev/data/+rfkill:* r,
 
+  @{sys}/devices/**/rfkill[0-9]*/{uevent,name} r,
+
+  /dev/rfkill rw,
+
   include if exists <local/systemd-rfkill>
 }

apparmor.d/groups/systemd/systemd-timesyncd

@@ -21,6 +21,11 @@ profile systemd-timesyncd @{exec_path} flags=(attach_disconnected) {
   network inet stream,
   network inet6 stream,
 
+  dbus send bus=system path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus
+       member=RequestName
+       peer=(name=org.freedesktop.DBus),
+
   dbus bind bus=system
        name=org.freedesktop.timesync1,
 

apparmor.d/groups/systemd/systemd-udevd

@@ -37,15 +37,17 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
   @{exec_path} mr,
 
   /{usr/,}bin/{,ba,da}sh        rix,
-  /{usr/,}bin/perl              rix,
+  /{usr/,}bin/{,e}grep          rix,
   /{usr/,}bin/chgrp             rix,
   /{usr/,}bin/chmod             rix,
-  /{usr/,}bin/setfacl           rix,
+  /{usr/,}bin/ln                rix,
   /{usr/,}bin/logger            rix,
   /{usr/,}bin/nohup             rix,
-  /{usr/,}bin/{,e}grep          rix,
-  /{usr/,}bin/ln                rix,
+  /{usr/,}bin/perl              rix,
   /{usr/,}bin/readlink          rix,
+  /{usr/,}bin/setfacl           rix,
+  /{usr/,}bin/unshare           rix,
+  /{usr/,}bin/snap              rPx,
 
   /{usr/,}{s,}bin/*             rPUx,