feat(profiles): general update.

apparmor.d/profiles-a-f/aa-log

@@ -28,5 +28,7 @@ profile aa-log @{exec_path} {
   @{PROC}/sys/kernel/random/boot_id r,
   @{PROC}/sys/kernel/cap_last_cap r,
 
+  /dev/tty[0-9]* rw,
+
   include if exists <local/aa-log>
 }

apparmor.d/profiles-a-f/dumpe2fs

@@ -21,5 +21,7 @@ profile dumpe2fs @{exec_path} {
   owner @{run}/blkid/blkid.tab{,-*} rw,
   owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
 
+  /dev/tty[0-9]* rw,
+
   include if exists <local/dumpe2fs>
 }

apparmor.d/profiles-a-f/e2fsck

@@ -28,6 +28,7 @@ profile e2fsck @{exec_path} {
   owner @{user_img_dirs}/{,**} rwk,
 
         @{run}/blkid/ rw,
+        @{run}/systemd/fsck.progress rw,
   owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
   owner @{run}/blkid/blkid.tab{,-*} rw,
 

apparmor.d/profiles-a-f/fail2ban-server

@@ -10,8 +10,14 @@ include <tunables/global>
 profile fail2ban-server @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
+  include <abstractions/openssl>
   include <abstractions/python>
 
+  capability dac_read_search,
+  capability net_admin,
+
+  network netlink raw,
+
   @{exec_path} mr,
 
   /{usr/,}bin/{,ba,da}sh             rix,
@@ -27,8 +33,8 @@ profile fail2ban-server @{exec_path} flags=(attach_disconnected) {
   /var/log/auth.log r,
   /var/log/fail2ban.log w,
 
-  @{run}/fail2ban/fail2ban.pid w,
-  @{run}/fail2ban/fail2ban.sock w,
+  @{run}/fail2ban/fail2ban.pid rw,
+  @{run}/fail2ban/fail2ban.sock rw,
   @{run}/resolvconf/resolv.conf r,
 
   owner @{PROC}/@{pid}/fd/ r,