feat(profiles): general update.

apparmor.d/groups/systemd/hostnamectl

@@ -14,5 +14,7 @@ profile hostnamectl @{exec_path} {
 
   /etc/machine-id r,
 
+  @{PROC}/sys/kernel/random/boot_id r,
+
   include if exists <local/hostnamectl>
 }

apparmor.d/groups/systemd/networkctl

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2020-2021 Mikhail Morfikov
+# Copyright (C) 2020-2022 Mikhail Morfikov
+# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -29,17 +30,13 @@ profile networkctl @{exec_path} flags=(complain) {
   /{usr/,}bin/less             rPx -> child-pager,
   /{usr/,}bin/more             rPx -> child-pager,
 
-  @{sys}/devices/**/net/**/uevent r,
+  /etc/udev/hwdb.bin r,
+  /var/lib/dbus/machine-id r,
+  /etc/machine-id r,
 
   @{run}/systemd/netif/links/[0-9]* r,
   @{run}/systemd/netif/state r,
 
-  owner @{PROC}/@{pid}/cgroup r,
-  owner @{PROC}/@{pid}/stat r,
-        @{PROC}/sys/kernel/random/boot_id r,
-
-  /etc/udev/hwdb.bin r,
-
   # To be able to read logs
   @{run}/log/ r,
   /{run,var}/log/journal/ r,
@@ -48,8 +45,11 @@ profile networkctl @{exec_path} flags=(complain) {
   /{run,var}/log/journal/[0-9a-f]*/system.journal* r,
   /{run,var}/log/journal/[0-9a-f]*/system@[0-9a-f]*.journal* r,
 
-  /var/lib/dbus/machine-id r,
-  /etc/machine-id r,
+  @{sys}/devices/**/net/**/uevent r,
 
-  include if exists <local/networkctld>
+  owner @{PROC}/@{pid}/cgroup r,
+  owner @{PROC}/@{pid}/stat r,
+        @{PROC}/sys/kernel/random/boot_id r,
+
+  include if exists <local/networkctl>
 }

apparmor.d/groups/systemd/systemd-coredump

@@ -35,7 +35,7 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected) {
   /etc/systemd/coredump.conf r,
 
         /var/lib/systemd/coredump/ r,
-  owner /var/lib/systemd/coredump/#[0-9]* rw,
+  owner /var/lib/systemd/coredump/#[0-9]* rwl,
   owner /var/lib/systemd/coredump/core.*.zst rwl -> /var/lib/systemd/coredump/#[0-9]*,
 
   owner @{PROC}/@{pid}/setgroups r,

apparmor.d/groups/systemd/systemd-environment-d-generator

@@ -20,6 +20,7 @@ profile systemd-environment-d-generator @{exec_path} {
   /{usr/,}bin/mawk        rix,
 
   /etc/environment r,
+  /etc/environment.d/{,**} r,
 
   owner @{user_config_dirs}/environment.d/{,*.conf} r,
 

apparmor.d/groups/systemd/systemd-fsck

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2020-2021 Mikhail Morfikov
+# Copyright (C) 2020-2022 Mikhail Morfikov
+# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -13,17 +14,16 @@ profile systemd-fsck @{exec_path} {
   include <abstractions/disks-read>
   include <abstractions/systemd-common>
 
+  capability net_admin,
   capability sys_resource,
 
-  # Needed?
-  deny capability net_admin,
-
   @{exec_path} mr,
 
   /{usr/,}{s,}bin/fsck   rPx,
   /{usr/,}{s,}bin/e2fsck rPx,
 
   owner @{run}/systemd/quotacheck w,
+  owner @{run}/systemd/fsck.progress rw,
 
   include if exists <local/systemd-fsck>
 }

apparmor.d/groups/systemd/systemd-fsckd

@@ -12,14 +12,12 @@ profile systemd-fsckd @{exec_path} {
   include <abstractions/consoles>
   include <abstractions/systemd-common>
 
+  capability net_admin,
   capability sys_tty_config,
 
-  # Needed?
-  deny capability net_admin,
-
   @{exec_path} mr,
 
-  owner @{run}/systemd/fsck.progress w,
+  @{run}/systemd/fsck.progress rw,
 
   include if exists <local/systemd-fsckd>
 }

apparmor.d/groups/systemd/systemd-journald

@@ -45,10 +45,11 @@ profile systemd-journald @{exec_path} {
   @{run}/udev/data/+bluetooth:* r,
   @{run}/udev/data/+hid:*       r,
   @{run}/udev/data/+pci:*       r,
-  @{run}/udev/data/+platform* r,
+  @{run}/udev/data/+platform*   r,
   @{run}/udev/data/+scsi:*      r,
   @{run}/udev/data/+usb-serial:* r,
   @{run}/udev/data/+usb:*       r,
+  @{run}/udev/data/+virtio:*    r,
   @{run}/udev/data/c10:224      r, # for /dev/tpm0
   @{run}/udev/data/c189:[0-9]*  r, # for /dev/bus/usb/**
   @{run}/udev/data/c23[0-9]:[0-9]* r,

apparmor.d/groups/systemd/systemd-oomd

@@ -19,9 +19,9 @@ profile systemd-oomd @{exec_path} flags=(attach_disconnected) {
 
   /etc/systemd/oomd.conf r,
 
-  owner @{run}/systemd/notify rw,
   owner @{run}/systemd/journal/socket w,
         @{run}/systemd/io.system.ManagedOOM rw,
+        @{run}/systemd/notify rw,
 
   @{sys}/fs/cgroup/cgroup.controllers r,
   @{sys}/fs/cgroup/memory.pressure r,

apparmor.d/groups/systemd/systemd-resolved

@@ -34,9 +34,11 @@ profile systemd-resolved @{exec_path} flags=(attach_disconnected) {
   /etc/systemd/resolved.conf.d/{,*} r,
 
   owner @{run}/systemd/journal/socket w,
-  owner @{run}/systemd/notify rw,
         @{run}/systemd/netif/links/* r,
+        @{run}/systemd/notify rw,
         @{run}/systemd/resolve/{,**} rw,
 
+  @{PROC}/sys/kernel/hostname r,
+
   include if exists <local/systemd-timesyncd>
 }