Update profile from #25.

apparmor.d/groups/systemd/child-systemctl

@@ -28,6 +28,8 @@ profile child-systemctl flags=(attach_disconnected) {
 
   /{usr/,}bin/systemctl mr,
 
+  /etc/systemd/user/{,**} rwl,
+
   owner @{PROC}/@{pid}/stat r,
         @{PROC}/sys/kernel/osrelease r,
         @{PROC}/1/environ r,

apparmor.d/groups/systemd/journalctl

@@ -14,9 +14,10 @@ profile journalctl @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/systemd-common>
 
-  capability sys_resource,
-  capability dac_read_search,
   capability dac_override,
+  capability dac_read_search,
+  capability net_admin,
+  capability sys_resource,
 
   signal (send) peer=child-pager,
 

apparmor.d/groups/systemd/systemd-hostnamed

@@ -28,8 +28,9 @@ profile systemd-hostnamed @{exec_path} {
   @{run}/udev/data/+dmi:id r,
   @{sys}/firmware/dmi/entries/*/raw r,
 
-  /etc/hostname rw,
   /etc/.#hostname* rw,
+  /etc/hostname rw,
+  /etc/machine-info r,
 
   @{run}/udev/data/+dmi:id r,
 

apparmor.d/groups/systemd/systemd-logind

@@ -22,10 +22,11 @@ profile systemd-logind @{exec_path} flags=(complain) {
 
   @{exec_path} mr,
 
-  /etc/systemd/sleep.conf r,
-  /etc/systemd/logind.conf r,
-  /etc/passwd r,
+  /etc/machine-id r,
   /etc/nsswitch.conf r,
+  /etc/passwd r,
+  /etc/systemd/logind.conf r,
+  /etc/systemd/sleep.conf r,
 
   /boot/{,**} r,
 

apparmor.d/groups/systemd/zram-generator

@@ -16,6 +16,8 @@ profile zram-generator @{exec_path} {
   /{usr/,}lib/systemd/systemd-makefs rPx,
   /{usr/,}bin/systemd-detect-virt rPx,
 
+  /etc/systemd/zram-generator.conf r,
+
   @{sys}/devices/virtual/block/zram[0-9]*/{disksize,reset} rw,
   @{sys}/block/zram[0-9]*/{disksize,reset} rw,