feat(profiles): general update.

apparmor.d/groups/systemd/systemd-machine-id-setup

@@ -7,16 +7,24 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}bin/systemd-machine-id-setup
-profile systemd-machine-id-setup @{exec_path} {
+profile systemd-machine-id-setup @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
 
   capability dac_override,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
+  capability sys_chroot,
 
   ptrace (read),
 
+  mount /,
+  umount /etc/machine-id,
+
   @{exec_path} mr,
 
+  / r,
   /etc/machine-id rw,
   /etc/ r,
   /var/ r,
@@ -25,6 +33,7 @@ profile systemd-machine-id-setup @{exec_path} {
         @{PROC}/cmdline r,
         @{PROC}/sys/kernel/osrelease r,
   owner @{PROC}/@{pid}/stat r,
+  owner @{PROC}/@{pid}/setgroups r,
 
   include if exists <local/systemd-machine-id-setup>
 }

apparmor.d/groups/systemd/systemd-sleep-grub2

@@ -18,7 +18,11 @@ profile systemd-sleep-grub @{exec_path} {
 
   /etc/sysconfig/bootloader r,
 
+  /var/lib/nscd/passwd r,
+
   @{PROC}/@{pid}/maps r,
 
+  /dev/tty rw,
+
   include if exists <local/systemd-sleep-grub>
 }