Update profiles.

apparmor.d/groups/gnome/gnome-control-center

@@ -58,7 +58,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
   owner @{user_cache_dirs}/mesa_shader_cache/index rw,
   owner @{user_cache_dirs}/thumbnails/{,**} rw,
   owner @{user_config_dirs}/gnome-control-center/{,**} rw,
-  owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
+  owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
   owner @{user_share_dirs}/backgrounds/{,**} rw,
   owner @{user_share_dirs}/gvfs-metadata/home{,-*.log} r,
   owner @{user_share_dirs}/icc/{,edid-*} r,

apparmor.d/groups/gnome/gsd-housekeeping

@@ -22,7 +22,7 @@ profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) {
   /usr/share/gdm/greeter-dconf-defaults r,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
-  owner @{user_cache_dirs}/thumbnails/fail/gnome-thumbnail-factory/ r,
+  owner @{user_cache_dirs}/thumbnails/{,**} rw,
 
   include <abstractions/dconf>
   owner @{run}/user/@{uid}/dconf/ rw,

apparmor.d/groups/pacman/pacman

@@ -48,6 +48,7 @@ profile pacman @{exec_path} {
   /{usr/,}bin/dot                         rix,
   /{usr/,}bin/env                         rix,
   /{usr/,}bin/rm                          rix,
+  /{usr/,}bin/setcap                      rix,
   /{usr/,}bin/vercmp                      rix,
   /{usr/,}bin/xmlcatalog                  rix,
   /{usr/,}lib/ghc-*/bin/ghc-pkg           rix,

apparmor.d/groups/pacman/pacman-hook-depmod

@@ -10,11 +10,16 @@ include <tunables/global>
 profile pacman-hook-depmod @{exec_path} {
   include <abstractions/base>
 
+  capability dac_read_search,
+
   @{exec_path} mr,
 
-  /{usr/,}bin/bash   rix,
-  /{usr/,}bin/kmod   rPx,
-  /{usr/,}bin/depmod rPx,
+  /{usr/,}bin/basename  rix,
+  /{usr/,}bin/bash      rix,
+  /{usr/,}bin/depmod    rPx,
+  /{usr/,}bin/kmod      rPx,
+
+  /dev/tty rw,
 
   # Inherit Silencer
   deny network inet6 stream,

apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove

@@ -10,13 +10,18 @@ include <tunables/global>
 profile pacman-hook-mkinitcpio-remove @{exec_path} {
   include <abstractions/base>
 
+  capability dac_read_search,
+
   @{exec_path} mr,
 
   /{usr/,}bin/bash  rix,
-  /{usr/,}bin/rm    rix,
+  /{usr/,}bin/cmp   rix,
   /{usr/,}bin/mv    rix,
+  /{usr/,}bin/rm    rix,
+  /{usr/,}bin/sed   rix,
 
   /usr/share/mkinitcpio/*.preset r,
+  /etc/mkinitcpio.d/*.preset rw,
 
   /boot/vmlinuz-* rw,
   /boot/initramfs-*.img rw,

apparmor.d/groups/systemd/systemd-timesyncd

@@ -25,11 +25,13 @@ profile systemd-timesyncd @{exec_path} {
 
   /etc/adjtime r,
   /etc/systemd/timesyncd.conf r,
+  /etc/systemd/timesyncd.conf.d/{,**} r,
 
   owner /var/lib/systemd/timesync/clock rw,
 
   owner @{run}/systemd/timesync/synchronized rw,
         @{run}/systemd/netif/state r,
+        @{run}/resolvconf/*.conf r,
 
   include if exists <local/systemd-timesyncd>
 }