Update profiles.

apparmor.d/groups/pacman/mkinitcpio

@@ -56,6 +56,8 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) {
 
   /{usr/,}lib/initcpio/busybox    rix,
   /{usr/,}lib/ld-*.so             rix,
+  /{usr/,}@{multiarch}/ld-*.so    rix,
+  /{usr/,}lib/@{multiarch}/ld-*.so  rix,
 
   /etc/fstab r,
   /etc/lvm/lvm.conf r,
@@ -68,6 +70,7 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) {
   # Can copy any program to the initframs
   /{usr/,}bin/ r,
   /{usr/,}bin/[a-z0-9]* rm,
+  /{usr/,}lib/udev/[a-z0-9]* rm,
   /{usr/,}lib/systemd/systemd-* rm,
 
   # Manage /boot

apparmor.d/groups/pacman/pacman

@@ -93,7 +93,7 @@ profile pacman @{exec_path} {
 
   @{PROC}/ r,
   @{run}/ r,
-  @{sys}/ r,
+  @{sys}/{,**} r,
   /mnt r,
 
   # Read packages files

apparmor.d/groups/pacman/pacman-hook-mkinitcpio-install

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /usr/share/libalpm/scripts/mkinitcpio-install
-profile pacman-hook-mkinitcpio-install @{exec_path} {
+profile pacman-hook-mkinitcpio-install @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
 
   capability dac_read_search,
@@ -37,6 +37,7 @@ profile pacman-hook-mkinitcpio-install @{exec_path} {
   # Inherit Silencer
   deny network inet6 stream,
   deny network inet stream,
+  deny /apparmor/.null rw,
 
   include if exists <local/pacman-hook-mkinitcpio-install>
 }

apparmor.d/groups/pacman/pacman-hook-systemd

@@ -19,12 +19,12 @@ profile pacman-hook-systemd @{exec_path} {
 
   /{usr/,}bin/journalctl             rPx,
   /{usr/,}bin/systemctl              rPx -> child-systemctl,
-  /{usr/,}bin/systemd-binfmt         rPx,
   /{usr/,}bin/systemd-detect-virt    rPx,
   /{usr/,}bin/systemd-hwdb           rPx,
   /{usr/,}bin/systemd-sysusers       rPx,
   /{usr/,}bin/systemd-tmpfiles       rPx,
   /{usr/,}bin/udevadm                rPx,
+  /{usr/,}lib/systemd-binfmt         rPx,
   /{usr/,}lib/systemd/systemd-sysctl rPx,
 
   /usr/ rw,