feat(profiles): general update.

apparmor.d/groups/gnome/gnome-session-binary

@@ -157,6 +157,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
 
   /{usr/,}bin/aa-notify                                    rPx,
   /{usr/,}bin/baloo_file                                   rPx,
+  @{libexec}/baloo_file                                    rPx,
   /{usr/,}bin/blueman-applet                               rPx,
   /{usr/,}bin/firewall-applet                             rPUx,
   /{usr/,}bin/gnome-keyring-daemon                         rPx,

apparmor.d/groups/gnome/tracker-extract

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = @{libexec}/tracker-extract-3
-profile tracker-extract @{exec_path} {
+profile tracker-extract @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/dbus-session-strict>
   include <abstractions/dconf-write>

apparmor.d/groups/network/mullvad-daemon

@@ -40,6 +40,7 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) {
   "/opt/Mullvad VPN/resources/*" r,
 
   /etc/mullvad-vpn/{,*} r,
+  /etc/mullvad-vpn/@{uid} rw,
   /etc/mullvad-vpn/*.json rw,
   @{etc_rw}/resolv.conf rw,
   @{etc_rw}/resolv.conf.mullvadbackup rw,

apparmor.d/groups/ssh/ssh

@@ -27,6 +27,7 @@ profile ssh @{exec_path} {
   /{usr/,}bin/{,b,d,rb}ash  rix,
   /{usr/,}bin/{c,k,tc,z}sh  rix,
 
+  @{etc_ro}/ssh/ssh_config r,
   @{etc_ro}/ssh/sshd_config r,
   @{etc_ro}/ssh/sshd_config.d/{,*} r,
 

apparmor.d/groups/systemd/systemd-machine-id-setup

@@ -7,16 +7,24 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}bin/systemd-machine-id-setup
-profile systemd-machine-id-setup @{exec_path} {
+profile systemd-machine-id-setup @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
 
   capability dac_override,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
+  capability sys_chroot,
 
   ptrace (read),
 
+  mount /,
+  umount /etc/machine-id,
+
   @{exec_path} mr,
 
+  / r,
   /etc/machine-id rw,
   /etc/ r,
   /var/ r,
@@ -25,6 +33,7 @@ profile systemd-machine-id-setup @{exec_path} {
         @{PROC}/cmdline r,
         @{PROC}/sys/kernel/osrelease r,
   owner @{PROC}/@{pid}/stat r,
+  owner @{PROC}/@{pid}/setgroups r,
 
   include if exists <local/systemd-machine-id-setup>
 }

apparmor.d/groups/systemd/systemd-sleep-grub2

@@ -18,7 +18,11 @@ profile systemd-sleep-grub @{exec_path} {
 
   /etc/sysconfig/bootloader r,
 
+  /var/lib/nscd/passwd r,
+
   @{PROC}/@{pid}/maps r,
 
+  /dev/tty rw,
+
   include if exists <local/systemd-sleep-grub>
 }