feat: update profiles.

apparmor.d/profiles-g-l/hostname

@@ -18,5 +18,7 @@ profile hostname @{exec_path} {
 
   @{exec_path} mr,
 
+  @{run}/resolvconf/resolv.conf r,
+
   include if exists <local/hostname>
 }

apparmor.d/profiles-g-l/ifup

@@ -52,7 +52,10 @@ profile ifup @{exec_path} {
 
     /{usr/,}bin/run-parts mr,
 
+    /{usr/,}lib/bridge-utils/ifupdown.sh       rPUx,
+
     /etc/network/if-down.d/ r,
+    /etc/network/if-down.d/resolvconf          rPUx,
     /etc/network/if-down.d/openvpn             rPUx,
     /etc/network/if-down.d/wpasupplicant       rPUx,
     /etc/wpa_supplicant/ifupdown.sh            rPUx,
@@ -70,7 +73,6 @@ profile ifup @{exec_path} {
 
     /etc/network/if-pre-up.d/ r,
     /etc/network/if-pre-up.d/bridge            rPUx,
-    /{usr/,}lib/bridge-utils/ifupdown.sh       rPUx,
     /etc/network/if-pre-up.d/ethtool           rPUx,
     /etc/network/if-pre-up.d/hostapd           rPUx,
     /etc/network/if-pre-up.d/ifenslave         rPUx,
@@ -109,6 +111,7 @@ profile ifup @{exec_path} {
     include <abstractions/base>
 
 #    capability mac_admin,
+   capability net_admin,
    capability sys_admin,
 #    capability sys_resource,
 

apparmor.d/profiles-g-l/ip

@@ -10,6 +10,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}bin/ip
 profile ip @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/consoles>
 
   capability net_admin,
   capability sys_module,

apparmor.d/profiles-g-l/lsblk

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}bin/lsblk
 profile lsblk @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
   include <abstractions/disks-read>
   include <abstractions/nameservice-strict>