feat(profiles): general update.

apparmor.d/profiles-a-f/blkdeactivate

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2022 Jeroen Rijken
+# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -12,12 +13,14 @@ profile blkdeactivate @{exec_path} flags=(complain) {
   include <abstractions/nameservice-strict>
 
   @{exec_path} rm,
-  /{usr/,}{s,}bin/dmsetup rPUx,
-  /{usr/,}bin/grep rix,
-  /{usr/,}bin/lsblk rPx,
-  /{usr/,}{s,}bin/lvm rPx,
-  /{usr/,}bin/sort rix,
-  /{usr/,}bin/umount rPx,
+
+  /{usr/,}{s,}bin/multipathd  rPx,
+  /{usr/,}{s,}bin/dmsetup     rPUx,
+  /{usr/,}{s,}bin/lvm         rPx,
+  /{usr/,}bin/grep            rix,
+  /{usr/,}bin/lsblk           rPx,
+  /{usr/,}bin/sort            rix,
+  /{usr/,}bin/umount          rPx,
 
   @{sys}/devices/virtual/block/*/holders/ r,
 

apparmor.d/profiles-a-f/flatpak-system-helper

@@ -19,6 +19,9 @@ profile flatpak-system-helper @{exec_path} {
   capability setgid,
   capability setuid,
   capability sys_nice,
+  capability sys_ptrace,
+
+  ptrace (read),
 
   @{exec_path} mr,
 
@@ -40,6 +43,7 @@ profile flatpak-system-helper @{exec_path} {
   owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
 
   owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/stat r,
 
   profile gpg {
     include <abstractions/base>

apparmor.d/profiles-a-f/losetup

@@ -17,6 +17,7 @@ profile losetup @{exec_path} {
 
   @{exec_path} mr,
 
+  @{sys}/devices/**/usb[0-9]/{,**} r,
   @{sys}/devices/system/cpu/possible r,
 
   /dev/loop-control rw,