feat(profile): various core update.

apparmor.d/groups/systemd/systemd-cryptsetup

@@ -31,6 +31,8 @@ profile systemd-cryptsetup @{exec_path} flags=(attach_disconnected) {
   @{sys}/devices/virtual/bdi/*/read_ahead_kb r,
   @{sys}/fs/ r,
 
+  @{run}/systemd/ask-password/ r,
+
         @{PROC}/devices r,
   owner @{PROC}/@{pid}/mountinfo r,
 

apparmor.d/groups/systemd/systemd-generator-ds-identify

@@ -18,6 +18,7 @@ profile systemd-generator-ds-identify @{exec_path} flags=(attach_disconnected) {
 
   @{sh_path}                     rix,
   @{bin}/blkid                   rPx,
+  @{bin}/grep                    rix,
   @{bin}/systemd-detect-virt     rPx,
   @{bin}/tr                      rix,
   @{bin}/uname                   rix,

apparmor.d/groups/systemd/systemd-modules-load

@@ -8,7 +8,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{exec_path} = @{lib}/systemd/systemd-modules-load
-profile systemd-modules-load @{exec_path} {
+profile systemd-modules-load @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/common/systemd>
 

apparmor.d/groups/systemd/systemd-remount-fs

@@ -7,7 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{exec_path} = @{lib}/systemd/systemd-remount-fs
-profile systemd-remount-fs @{exec_path} {
+profile systemd-remount-fs @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
   include <abstractions/common/systemd>
@@ -17,7 +17,7 @@ profile systemd-remount-fs @{exec_path} {
   capability sys_resource,
 
   mount options=(rw, remount) -> /,
-  mount options=(rw, remount) -> /proc/,
+  mount options=(rw, remount) -> @{PROC}/,
 
   @{exec_path} mr,
 

apparmor.d/groups/systemd/systemd-tty-ask-password-agent

@@ -17,10 +17,11 @@ profile systemd-tty-ask-password-agent @{exec_path} {
   capability net_admin,
   capability sys_resource,
 
-  signal (receive) set=(term cont) peer=*//systemctl,
-  signal (receive) set=(term cont) peer=default,
-  signal (receive) set=(term cont) peer=logrotate,
-  signal (receive) set=(term cont) peer=rpm,
+  signal receive set=(term cont) peer=*//systemctl,
+  signal receive set=(term cont) peer=default,
+  signal receive set=(term cont) peer=logrotate,
+  signal receive set=(term cont) peer=role_*,
+  signal receive set=(term cont) peer=rpm,
 
   @{exec_path} mrix,
 

apparmor.d/groups/systemd/zram-generator

@@ -27,8 +27,8 @@ profile zram-generator @{exec_path} flags=(attach_disconnected) {
   owner @{run}/systemd/generator/swap.target.wants/{,dev-zram@{int}.swap} rw,
   owner @{run}/systemd/generator/systemd-zram-setup@zram@{int}.service.d/{,*.conf} rw,
 
-  @{sys}/block/zram@{int}/{disksize,reset} rw,
-  @{sys}/devices/virtual/block/zram@{int}/{disksize,reset,comp_algorithm} rw,
+  @{sys}/block/zram@{int}/* rw,
+  @{sys}/devices/virtual/block/zram@{int}/* rw,
   @{sys}/module/compression r,
 
   @{PROC}/crypto r,