diff --git a/apparmor.d/groups/systemd/systemd-homed b/apparmor.d/groups/systemd/systemd-homed
index a89cd90f8..c53be3a35 100644
--- a/apparmor.d/groups/systemd/systemd-homed
+++ b/apparmor.d/groups/systemd/systemd-homed
@@ -14,6 +14,8 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) {
   include <abstractions/nameservice-strict>
   include <abstractions/common/systemd>
 
+  userns,
+
   capability chown,
   capability dac_override,
   capability dac_read_search,
@@ -24,6 +26,7 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) {
   capability setpcap,
   capability setuid,
   capability sys_admin,
+  capability sys_ptrace,
   capability sys_resource,
 
   network inet dgram,
@@ -32,16 +35,24 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) {
   network inet6 raw,
   network netlink raw,
 
-  mount options=(rw, rslave) -> @{run}/,
-  mount /dev/dm-@{int} -> @{run}/systemd/user-home-mount/,
+  mount                      -> @{run}/systemd/user-home-mount/,
+  mount options=(rw private) -> @{run}/systemd/user-home-mount/,
+  mount options=(rw rslave)  -> @{run}/,
+
+  umount @{run}/systemd/user-home-mount/,
+
+  signal (send receive) set=kill peer=systemd-homed//&systemd-homework,
+
+  ptrace read peer=systemd-homed//&systemd-homework,
 
   unix bind type=stream addr=@@{udbus}/bus/systemd-homed/system,
 
   #aa:dbus own bus=system name=org.freedesktop.home1
+  #aa:dbus talk bus=system name=org.freedesktop.PolicyKit1 label=polkitd
 
   @{exec_path} mr,
 
-  @{lib}/systemd/systemd-homework rPx -> systemd-homed//&systemd-homework,
+  @{lib}/systemd/systemd-homework rPx -> &systemd-homework,
   @{sbin}/mkfs.btrfs rPx,
   @{sbin}/mkfs.fat   rPx,
   @{sbin}/mke2fs     rPx,
@@ -74,9 +85,12 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) {
         @{PROC}/@{pid}/cgroup r,
         @{PROC}/devices r,
         @{PROC}/pressure/* r,
+        @{PROC}/swaps r,
+        @{PROC}/sys/fs/nr_open r,
         @{PROC}/sysvipc/{shm,sem,msg} r,
   owner @{PROC}/@{pid}/gid_map w,
   owner @{PROC}/@{pid}/mountinfo r,
+  owner @{PROC}/@{pid}/mounts r,
   owner @{PROC}/@{pid}/uid_map w,
 
   /dev/loop-control rwk,
diff --git a/apparmor.d/groups/systemd/systemd-homework b/apparmor.d/groups/systemd/systemd-homework
index f0fe98a16..b81c196f8 100644
--- a/apparmor.d/groups/systemd/systemd-homework
+++ b/apparmor.d/groups/systemd/systemd-homework
@@ -7,14 +7,68 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{exec_path} = @{lib}/systemd/systemd-homework
-profile systemd-homework @{exec_path} {
+profile systemd-homework @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
-  include <abstractions/nameservice-strict>
   include <abstractions/common/systemd>
+  include <abstractions/disks-write>
+  include <abstractions/nameservice-strict>
+
+  userns,
+
+  capability chown,
+  capability fowner,
+  capability fsetid,
+  capability setfcap,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
+  capability sys_resource,
+
+  network netlink raw,
+
+  mount options=(rw rslave) -> @{run}/,
+  mount                     -> @{run}/systemd/user-home-mount/,
+
+  umount @{run}/systemd/user-home-mount/,
+
+  signal (send receive) set=kill peer=systemd-homed//&systemd-homework,
+
+  ptrace read peer=systemd-homed//&systemd-homework,
 
   @{exec_path} mr,
 
+  @{sbin}/mkfs.btrfs rPx,
+  @{sbin}/mkfs.fat   rPx,
+  @{sbin}/mke2fs     rPx,
+
   /etc/machine-id r,
+  /etc/skel/{,**} r,
+
+  /var/cache/systemd/home/{,**} rw,
+
+  @{HOMEDIRS}/ r,
+  @{HOMEDIRS}/.#homework@{user}.* rw,
+  @{HOMEDIRS}/@{user}.home rw,
+
+  @{run}/ r,
+  @{run}/cryptsetup/ r,
+  @{run}/cryptsetup/* rwk,
+  @{run}/systemd/user-home-mount/ rw,
+  @{run}/systemd/user-home-mount/@{user}/{,**} rw,
+
+  @{sys}/fs/ r,
+
+        @{PROC}/devices r,
+        @{PROC}/swaps r,
+        @{PROC}/sys/fs/nr_open r,
+  owner @{PROC}/@{pid}/gid_map w,
+  owner @{PROC}/@{pid}/mountinfo r,
+  owner @{PROC}/@{pid}/mounts r,
+  owner @{PROC}/@{pid}/uid_map w,
+
+  /dev/loop-control rwk,
+  /dev/loop@{int} rw,
+  /dev/mapper/control rw,
 
   include if exists <local/systemd-homework>
 }