Update profiles.

apparmor.d/groups/pacman/paccache

@@ -20,7 +20,7 @@ profile paccache @{exec_path} {
   /{usr/,}bin/cat          rix,
   /{usr/,}bin/gawk         rix,
   /{usr/,}bin/gettext      rix,
-  /{usr/,}bin/pacman       rPUx,
+  /{usr/,}bin/pacman       rPx,
   /{usr/,}bin/pacman-conf  rPx,
   /{usr/,}bin/pacsort      rix,
   /{usr/,}bin/rm           rix,

apparmor.d/groups/pacman/pacman

@@ -55,6 +55,7 @@ profile pacman @{exec_path} {
   /{usr/,}bin/install-info                rPx,
   /{usr/,}bin/killall                     rPx,
   /{usr/,}bin/pacdiff                     rPx,
+  /{usr/,}bin/pacman-key                  rPx,
   /{usr/,}bin/sysctl                      rPx,
   /{usr/,}bin/systemctl                   rPx -> child-systemctl,
   /{usr/,}bin/update-ca-trust             rPx,

apparmor.d/groups/pacman/pacman-hook-dconf

@@ -18,5 +18,11 @@ profile pacman-hook-dconf @{exec_path} {
 
   /etc/dconf/db/{,**} rw,
 
+  /dev/tty rw,
+
+  # Inherit Silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
   include if exists <local/pacman-hook-dconf>
 }

apparmor.d/groups/pacman/pacman-hook-depmod

@@ -15,5 +15,9 @@ profile pacman-hook-depmod @{exec_path} {
   /{usr/,}bin/bash   rix,
   /{usr/,}bin/depmod rPx,
 
+  # Inherit Silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
   include if exists <local/pacman-hook-depmod>
 }

apparmor.d/groups/pacman/pacman-hook-dkms

@@ -12,5 +12,11 @@ profile pacman-hook-dkms @{exec_path} {
 
   @{exec_path} mr,
 
+  /{usr/,}bin/kmod rPx,
+
+  # Inherit Silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
   include if exists <local/pacman-hook-dkms>
 }

apparmor.d/groups/pacman/pacman-hook-gio

@@ -16,7 +16,14 @@ profile pacman-hook-gio @{exec_path} {
   /{usr/,}bin/rmdir            rix,
   /{usr/,}bin/gio-querymodules rPx,
 
-  /{usr/,}lib/gio/modules/{,**} rw,
+  /{usr/,}lib/gio/modules/giomodule.cache{,.[0-9A-Z]*} rw,
+  /{usr/,}lib/gtk-{3,4}.0/**/*/ rw,
+
+  /dev/tty rw,
+
+  # Inherit Silencer
+  deny network inet6 stream,
+  deny network inet stream,
 
   include if exists <local/pacman-hook-gio>
 }

apparmor.d/groups/pacman/pacman-hook-mkinitcpio-install

@@ -13,6 +13,8 @@ profile pacman-hook-mkinitcpio-install @{exec_path} {
   capability dac_read_search,
   capability mknod,
 
+  unix (receive) type=stream,
+
   @{exec_path} mr,
 
   /{usr/,}bin/bash       rix,
@@ -25,7 +27,9 @@ profile pacman-hook-mkinitcpio-install @{exec_path} {
   /usr/share/mkinitcpio/*.preset r,
 
   /etc/mkinitcpio.d/{,**} r,
+  /etc/mkinitcpio.d/*.preset rw,
 
+  / r,
   owner /boot/vmlinuz-* rw,
 
   /dev/tty rw,

apparmor.d/groups/pacman/pacman-hook-perl

@@ -10,6 +10,9 @@ include <tunables/global>
 profile pacman-hook-perl @{exec_path} {
   include <abstractions/base>
 
+  capability dac_read_search,
+  capability mknod,
+
   @{exec_path} mr,
 
   /{usr/,}bin/perl    rix,

apparmor.d/groups/pacman/pacman-hook-systemd

@@ -17,15 +17,15 @@ profile pacman-hook-systemd @{exec_path} {
   /{usr/,}bin/bash  rix,
   /{usr/,}bin/touch rix,
 
-  /{usr/,}bin/journalctl           rPx,
-  /{usr/,}bin/systemctl            rPx -> child-systemctl,
-  /{usr/,}bin/systemd-binfmt       rPx,
-  /{usr/,}bin/systemd-detect-virt  rPx,
-  /{usr/,}bin/systemd-hwdb         rPx,
-  /{usr/,}bin/systemd-sysctl       rPx,
-  /{usr/,}bin/systemd-sysusers     rPx,
-  /{usr/,}bin/systemd-tmpfiles     rPx,
-  /{usr/,}bin/udevadm              rPx,
+  /{usr/,}bin/journalctl             rPx,
+  /{usr/,}bin/systemctl              rPx -> child-systemctl,
+  /{usr/,}bin/systemd-binfmt         rPx,
+  /{usr/,}bin/systemd-detect-virt    rPx,
+  /{usr/,}bin/systemd-hwdb           rPx,
+  /{usr/,}bin/systemd-sysusers       rPx,
+  /{usr/,}bin/systemd-tmpfiles       rPx,
+  /{usr/,}bin/udevadm                rPx,
+  /{usr/,}lib/systemd/systemd-sysctl rPx,
 
   /usr/ rw,