feat(profile): initial integration with attached path.

The feature is not yet enabled.

See https://apparmor.pujol.io/development/internal/#re-attached-path

apparmor.d/groups/virt/dockerd

@@ -85,9 +85,9 @@ profile dockerd @{exec_path} flags=(attach_disconnected) {
 
   /etc/docker/{,**} r,
 
-  / r,
+  @{att}/ r,
 
-  owner @{lib}/containerd/** w,
+  owner @{att}/@{lib}/containerd/** rw,
   owner @{lib}/docker/overlay2/*/work/{,**} rw,
   owner /var/lib/containerd/** rw,
   owner /var/lib/docker/{,**} rwk,

apparmor.d/groups/virt/libvirtd

@@ -153,11 +153,12 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
   @{user_vm_dirs}/{,**} rwk,
   @{user_publicshare_dirs}/{,**} rwk,
 
+  @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
+
   @{run}/libvirt/ rw,
   @{run}/libvirt/** rwk,
   @{run}/libvirtd.pid wk,
   @{run}/lock/LCK.._pts_@{int} rw,
-  @{run}/systemd/inhibit/@{int}.ref rw,
   @{run}/systemd/notify w,
   @{run}/utmp rk,
 

apparmor.d/groups/virt/virtinterfaced

@@ -20,7 +20,7 @@ profile virtinterfaced @{exec_path} flags=(attach_disconnected) {
   @{lib}/gconv/gconv-modules rm,
   @{lib}/gconv/gconv-modules.d/{,*} r,
 
-        @{run}/systemd/inhibit/@{int}.ref rw,
+        @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
   owner @{run}/user/@{uid}/libvirt/common/system.token rwk,
   owner @{run}/user/@{uid}/libvirt/interface/ rw,
   owner @{run}/user/@{uid}/libvirt/interface/run/{,*} rwk,

apparmor.d/groups/virt/virtlogd

@@ -28,9 +28,10 @@ profile virtlogd @{exec_path} flags=(attach_disconnected) {
   owner @{run}/user/@{uid}/libvirt/virtlogd.pid rwk,
   owner @{run}/user/@{uid}/libvirt/virtlogd* w,
 
+  @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
+
   @{run}/libvirt/common/system.token rwk,
   @{run}/libvirt/virtlogd-sock rw,
-  @{run}/systemd/inhibit/@{int}.ref rw,
   @{run}/virtlogd.pid rwk,
 
   @{sys}/devices/system/node/ r,

apparmor.d/groups/virt/virtnetworkd

@@ -24,8 +24,9 @@ profile virtnetworkd @{exec_path} flags=(attach_disconnected) {
 
   owner /var/lib/libvirt/dnsmasq/*.macs* rw,
 
+  @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
+
         @{run}/libvirt/network/default.pid r,
-        @{run}/systemd/inhibit/@{int}.ref rw,
         @{run}/utmp rk,
   owner @{run}/libvirt/common/system.token rwk,
   owner @{run}/libvirt/network/{,**} rwk,

apparmor.d/groups/virt/virtnodedevd

@@ -32,7 +32,8 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) {
   /etc/libvirt/*.conf r,
   /etc/mdevctl.d/{,**} r,
 
-        @{run}/systemd/inhibit/@{int}.ref rw,
+  @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
+
   owner @{run}/libvirt/common/system.token rwk,
   owner @{run}/libvirt/nodedev/ rw,
   owner @{run}/libvirt/nodedev/driver.pid wk,

apparmor.d/groups/virt/virtsecretd

@@ -20,7 +20,8 @@ profile virtsecretd @{exec_path} flags=(attach_disconnected) {
   owner @{user_config_dirs}/libvirt/secrets/ rw,
   owner @{user_config_dirs}/libvirt/secrets/run/{,*} rwk,
 
-        @{run}/systemd/inhibit/@{int}.ref rw,
+  @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
+
   owner @{run}/user/@{uid}/libvirt/common/system.token rwk,
   owner @{run}/user/@{uid}/libvirt/secrets/ rw,
   owner @{run}/user/@{uid}/libvirt/secrets/run/{,*} rwk,

apparmor.d/groups/virt/virtstoraged

@@ -54,7 +54,8 @@ profile virtstoraged @{exec_path} flags=(attach_disconnected) {
   owner @{run}/libvirt/storage/{,**} rwk,
   owner @{run}/virtstoraged.pid rwk,
 
-  @{run}/systemd/inhibit/@{int}.ref rw,
+  @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
+
   @{run}/utmp rwk,
 
   @{sys}/devices/system/node/ r,