feat(profiles): general update.

apparmor.d/groups/systemd/systemd-detect-virt

@@ -26,6 +26,7 @@ profile systemd-detect-virt @{exec_path} flags=(attach_disconnected) {
   @{sys}/devices/virtual/dmi/id/product_name r,
   @{sys}/devices/virtual/dmi/id/product_version r,
   @{sys}/devices/virtual/dmi/id/sys_vendor r,
+  @{sys}/firmware/dmi/entries/*/raw r,
 
   # Inherit silencer
   deny /apparmor/.null rw,

apparmor.d/groups/systemd/systemd-modules-load

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2020-2021 Mikhail Morfikov
+# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -18,9 +19,9 @@ profile systemd-modules-load @{exec_path} {
 
   @{sys}/module/*/initstate r,
 
-  /etc/modules r,
   /etc/modprobe.d/ r,
   /etc/modprobe.d/*.conf r,
+  /etc/modules r,
   /etc/modules-load.d/ r,
   /etc/modules-load.d/*.conf r,
 

apparmor.d/groups/systemd/systemd-sysctl

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2020-2021 Mikhail Morfikov
+# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -17,16 +18,16 @@ profile systemd-sysctl @{exec_path} flags=(attach_disconnected) {
   capability sys_admin,
   capability sys_ptrace,
   capability sys_rawio,
-  # capability sys_resource,
 
   @{exec_path} mr,
 
-  @{PROC}/sys/** rw,
-
-  /etc/sysctl.d/ r,
-  /etc/sysctl.d/*.conf r,
-
+  # Config file locations
+  @{run}/sysctl.d/{,*.conf} r,
   /etc/sysctl.conf r,
+  /etc/sysctl.d/{,*.conf} r,
+  /usr/lib/sysctl.d/{,*.conf} r,
+
+  @{PROC}/sys/** rw,
 
   # Inherit Silencer
   deny /apparmor/.null rw,