feat(profiles): general update.

apparmor.d/groups/systemd/coredumpctl

@@ -12,6 +12,8 @@ profile coredumpctl @{exec_path} flags=(complain) {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
 
+  capability net_admin,
+
   signal (send) peer=child-pager,
 
   @{exec_path} mr,

apparmor.d/groups/systemd/networkctl

@@ -54,6 +54,7 @@ profile networkctl @{exec_path} flags=(attach_disconnected,complain) {
   @{sys}/devices/**/net/**/uevent r,
 
         @{PROC}/sys/kernel/random/boot_id r,
+        @{PROC}/1/cgroup r,
   owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/stat r,
 

apparmor.d/groups/systemd/systemd-logind

@@ -140,8 +140,8 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
   /dev/dri/card[0-9]* rw,
   /dev/input/event[0-9]* rw,  # Input devices (keyboard, mouse, etc)
   /dev/mqueue/ r,
-  /dev/shm/{,**/} rw,
   /dev/tty[0-9]* rw,
+  owner /dev/shm/{,**/} rw,
 
   include if exists <local/systemd-logind>
 }

apparmor.d/groups/systemd/systemd-tty-ask-password-agent

@@ -10,6 +10,7 @@ include <tunables/global>
 profile systemd-tty-ask-password-agent @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
+  include <abstractions/systemd-common>
 
 #  capability net_admin,
 
@@ -18,12 +19,10 @@ profile systemd-tty-ask-password-agent @{exec_path} {
   @{exec_path} mr,
 
   @{run}/systemd/ask-password-block/{,*} rw,
-  @{run}/systemd/ask-password/ r,
+  @{run}/systemd/ask-password/{,*} rw,
+  @{run}/utmp rk,
 
   @{PROC}/@{pids}/stat r,
-  @{PROC}/sys/kernel/osrelease r,
-  @{PROC}/cmdline r,
-  @{PROC}/1/environ r,
 
   include if exists <local/systemd-tty-ask-password-agent>
 }

apparmor.d/groups/systemd/systemd-udevd

@@ -38,18 +38,22 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
 
   /{usr/,}bin/{,ba,da}sh        rix,
   /{usr/,}bin/{,e}grep          rix,
+  /{usr/,}bin/cat               rix,
   /{usr/,}bin/chgrp             rix,
   /{usr/,}bin/chmod             rix,
+  /{usr/,}bin/cut               rix,
   /{usr/,}bin/ln                rix,
   /{usr/,}bin/logger            rix,
+  /{usr/,}bin/mknod             rPx,
   /{usr/,}bin/nohup             rix,
   /{usr/,}bin/perl              rix,
   /{usr/,}bin/readlink          rix,
   /{usr/,}bin/setfacl           rix,
-  /{usr/,}bin/unshare           rix,
   /{usr/,}bin/snap              rPx,
+  /{usr/,}bin/unshare           rix,
 
-  /{usr/,}{s,}bin/*             rPUx,
+  /{usr/,}{s,}bin/*             rpux,
+  audit /{usr/,}{s,}bin/lvm      rux,
 
   /{usr/,}lib/pm-utils/power.d/*          rPUx,
   /{usr/,}lib/snapd/snap-device-helper     rPx,
@@ -82,7 +86,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
   /etc/systemd/network/[0-9][0-9]-*.link r,
 
   @{run}/udev/ rw,
-  @{run}/udev/** rw,
+  @{run}/udev/** rwk,
 
   @{run}/systemd/network/ r,
   @{run}/systemd/notify rw,
@@ -90,12 +94,13 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
 
   @{sys}/** rw,
 
-  owner @{PROC}/@{pid}/loginuid r,
-  owner @{PROC}/@{pid}/oom_score_adj rw,
-  owner @{PROC}/@{pid}/fd/ r,
         @{PROC}/@{pids}/cgroup r,
         @{PROC}/devices r,
         @{PROC}/driver/nvidia/gpus/ r,
+        @{PROC}/driver/nvidia/gpus/*/information r,
+  owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/loginuid r,
+  owner @{PROC}/@{pid}/oom_score_adj rw,
 
   /dev/ rw,
   /dev/** rwk,