update apparmor profiles

apparmor.d/profiles-s-z/update-ca-certificates

@@ -10,6 +10,7 @@ include <tunables/global>
 profile update-ca-certificates @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
+  include <abstractions/openssl>
   include <abstractions/ssl_certs>
 
   @{exec_path} r,
@@ -37,7 +38,7 @@ profile update-ca-certificates @{exec_path} {
 
   /etc/ r,
   /etc/ca-certificates.conf r,
-  /etc/ssl/certs/ca-certificates.crt rw,
+  /etc/ssl/certs/ca-certificates.crt{,.new} rw,
   /etc/ssl/certs/*.pem rw,
   /etc/ssl/certs/[0-9a-f]*.[0-9] rw,
 

apparmor.d/profiles-s-z/usr.sbin.cupsd

@@ -72,6 +72,7 @@
   /etc/pnm2ppa.conf r,
   /etc/printcap rwl,
   /etc/ssl/** r,
+  /etc/letsencrypt/archive/** r,
   @{PROC}/net/ r,
   @{PROC}/net/* r,
   @{PROC}/sys/dev/parport/** r,

apparmor.d/profiles-s-z/wpa-action

@@ -0,0 +1,42 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}sbin/wpa_action
+profile wpa-action @{exec_path} {
+  include <abstractions/base>
+
+  capability net_admin,
+
+  network netlink raw,
+
+  @{exec_path} mr,
+
+  /{usr/,}sbin/wpa_cli   rPx,
+
+  /{usr/,}bin/{,ba,da}sh rix,
+  /{usr/,}bin/logger     rix,
+  /{usr/,}bin/ln         rix,
+  /{usr/,}sbin/ifup      rix,
+  /{usr/,}bin/rm         rix,
+  /{usr/,}bin/ip         rix,
+  /{usr/,}bin/{,e}grep   rix,
+  /{usr/,}bin/cat        rix,
+  /{usr/,}bin/date       rix,
+
+  /etc/wpa_supplicant/{,**} r,
+
+  owner @{run}/wpa_action.wlan[0-9]*.ifupdown rw,
+  owner @{run}/wpa_action.wlan[0-9]*.timestamp rw,
+  owner @{run}/network/ifstate.wlan[0-9]* rwk,
+  owner @{run}/sendsigs.omit.d/wpasupplicant.wpa_supplicant.wlan[0-9]*.pid rw,
+
+  /etc/network/interfaces r,
+  /etc/network/interfaces.d/{,*} r,
+
+  include if exists <local/wpa-action>
+}

apparmor.d/profiles-s-z/wpa-cli

@@ -0,0 +1,26 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}sbin/wpa_cli
+profile wpa-cli @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  /{usr/,}sbin/wpa_action rPx,
+
+  owner @{run}/wpa_supplicant/ r,
+  owner /tmp/wpa_ctrl_@{pid}-[0-9] rw,
+
+  # for interactive mode
+  /etc/inputrc r,
+  owner @{HOME}/.wpa_cli_history rw,
+  owner @{HOME}/.wpa_cli_history-[0-9]*.tmp rw,
+
+  include if exists <local/wpa-cli>
+}

apparmor.d/profiles-s-z/xorg

@@ -132,7 +132,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
   @{run}/udev/data/+input* r,          # for mouse, keyboard, touchpad
   @{run}/udev/data/+platform* r,       # for ?
   @{run}/udev/data/+drm:card[0-9]-* r, # for screen outputs
-  #@{run}/udev/data/+dmi* r,           # for ?
+  @{run}/udev/data/+dmi* r,            # for ?
   @{run}/udev/data/+acpi* r,           # for ?
   @{run}/udev/data/+hid* r,            # for HID-Compliant Keyboard
   @{run}/udev/data/+pci* r,            # for VGA compatible controller