feat(profiles): general update.

apparmor.d/profiles-s-z/s3fs

@@ -41,24 +41,25 @@ profile s3fs @{exec_path} {
     include <abstractions/base>
     include <abstractions/nameservice-strict>
 
+    capability dac_read_search,
     capability sys_admin,
 
     network inet stream,
     network inet6 stream,
 
-    /{usr/,}bin/fusermount{,3} mr,
-
-    /etc/fuse.conf r,
-
-    @{MOUNTS}/ r,
-    @{MOUNTS}/*/ r,
-
     mount fstype=fuse.s3fs -> @{MOUNTS}/,
     mount fstype=fuse.s3fs -> @{MOUNTS}/*/,
   
     umount @{MOUNTS}/,
     umount @{MOUNTS}/*/,
   
+    /{usr/,}bin/fusermount{,3} mr,
+
+    /etc/fuse.conf r,
+
+    @{MOUNTS}/ r,
+    @{MOUNTS}/*/ r,
+
     owner /tmp/s3fstmp.* rw,
 
     @{PROC}/@{pids}/mounts r,

apparmor.d/profiles-s-z/snapd

@@ -60,6 +60,7 @@ profile snapd @{exec_path} {
   /{usr/,}bin/{,ba,da}sh               rix,
   /{usr/,}bin/cp                       rix,
   /{usr/,}bin/gzip                     rix,
+  /{usr/,}bin/journalctl               rPx,
   /{usr/,}bin/mount                    rix,
   /{usr/,}bin/snap                     rPx,
   /{usr/,}bin/sync                     rix,
@@ -86,6 +87,7 @@ profile snapd @{exec_path} {
   /usr/share/dbus-1/services/*snap* r,
   /usr/share/polkit-1/actions/{,**/} r,
 
+  /etc/apparmor.d/*snapd.snap* r,
   /etc/dbus-1/system.d/{,**/} r,
   /etc/fstab r,
   /etc/mime.types r,
@@ -147,6 +149,7 @@ profile snapd @{exec_path} {
         @{PROC}/sys/kernel/random/boot_id r,
         @{PROC}/sys/kernel/seccomp/actions_avail r,
         @{PROC}/version r,
+  owner @{PROC}/@{pids}/cmdline r,
   owner @{PROC}/@{pids}/mountinfo r,
 
   /dev/loop-control rw,