feat(profile): improve some core profiles.

apparmor.d/groups/utils/blockdev

@@ -10,7 +10,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/blockdev
 profile blockdev @{exec_path} {
   include <abstractions/base>
-  include <abstractions/disks-read>
+  include <abstractions/disks-write>
 
   capability sys_admin,
 

apparmor.d/groups/utils/losetup

@@ -10,18 +10,23 @@ include <tunables/global>
 profile losetup @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
+  include <abstractions/devices-usb>
 
   capability dac_override,
   capability dac_read_search,
 
-  unix (receive) type=stream,
+  unix receive type=stream,
 
   @{exec_path} mr,
 
-  @{sys}/devices/**/usb[0-9]/{,**} r,
+  @{user_img_dirs}/** rw,
+  @{user_vm_dirs}/** rw,
+
+  @{sys}/block/ r,
+  @{sys}/devices/virtual/block/loop@{int}/{,**} r,
 
   /dev/loop-control rw,
-  /dev/loop[0-9]* rw,
+  /dev/loop@{int} rw,
 
   include if exists <local/losetup>
 }

apparmor.d/groups/utils/sulogin

@@ -9,9 +9,12 @@ include <tunables/global>
 @{exec_path} = @{bin}/sulogin
 profile sulogin @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
   include <abstractions/nameservice-strict>
 
+  capability checkpoint_restore,
   capability sys_admin,
+  capability sys_tty_config,
 
   @{exec_path} mr,
 
@@ -22,9 +25,6 @@ profile sulogin @{exec_path} {
 
   @{PROC}/consoles r,
 
-  /dev/ r,
-  /dev/tty@{int} rw,
-
   include if exists <local/sulogin>
 }