feat(profiles): general update.

apparmor.d/profiles-a-f/auditd

@@ -23,18 +23,18 @@ profile auditd @{exec_path} flags=(attach_disconnected) {
 
   /etc/audit/{,**} r,
 
-  /var/log/audit/{,**} rw,
-
   /etc/machine-id r,
 
+  /var/log/audit/{,**} rw,
+
+        @{run}/systemd/journal/dev-log w,
   owner @{run}/auditd.pid rwl,
   owner @{run}/auditd.state rw,
-        @{run}/systemd/journal/dev-log w,
 
   owner @{PROC}/@{pid}/attr/current r,
   owner @{PROC}/@{pid}/loginuid r,
-  owner @{PROC}/@{pid}/sessionid r,
   owner @{PROC}/@{pid}/oom_score_adj rw,
+  owner @{PROC}/@{pid}/sessionid r,
 
   include if exists <local/auditd>
 }

apparmor.d/profiles-a-f/augenrules

@@ -25,7 +25,7 @@ profile augenrules @{exec_path} {
   @{bin}/rm        rix,
 
   /etc/audit/audit.rules rw,
-  /etc/audit/rules.d/ r,
+  /etc/audit/rules.d/{,*} r,
 
   owner /tmp/aurules.* rw,
 

apparmor.d/profiles-a-f/fusermount

@@ -15,18 +15,6 @@ profile fusermount @{exec_path} {
   capability dac_read_search,
   capability sys_admin,
 
-  @{exec_path} mr,
-
-  /etc/fuse.conf r,
-  /etc/machine-id r,
-
-  # Where to mount ISO files
-  owner @{HOME}/*/ rw,
-  owner @{HOME}/*/*/ rw,
-  owner @{user_cache_dirs}/**/ rw,
-        @{run}/user/@{uid}/doc/ r,
-        /var/tmp/flatpak-cache-*/*/ r,
-
   # Be able to mount ISO images
   mount fstype={fuse,fuse.*} -> @{HOME}/*/,
   mount fstype={fuse,fuse.*} -> @{HOME}/*/*/,
@@ -45,6 +33,21 @@ profile fusermount @{exec_path} {
   umount @{run}/user/@{uid}/*/,
   umount /var/tmp/flatpak-cache-*/*/,
 
+  @{exec_path} mr,
+
+  /etc/fuse.conf r,
+  /etc/machine-id r,
+
+  /var/tmp/flatpak-cache-*/*/ r,
+
+  # Where to mount ISO files
+  owner @{HOME}/*/ rw,
+  owner @{HOME}/*/*/ rw,
+
+  owner @{user_cache_dirs}/**/ rw,
+
+  @{run}/user/@{uid}/doc/ r,
+
   @{PROC}/@{pid}/mounts r,
 
   /dev/fuse rw,