feat(profile): minor update & cosmetic.

apparmor.d/profiles-m-r/mandb

@@ -8,7 +8,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{exec_path} = @{bin}/mandb
-profile mandb @{exec_path} flags=(complain) {
+profile mandb @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
@@ -20,9 +20,6 @@ profile mandb @{exec_path} flags=(complain) {
   /etc/man_db.conf r,
   /etc/manpath.config r,
 
-  /var/cache/man/ r,
-  /var/cache/man/** rwk,
-
   /usr/share/man/{,**} r,
   /usr/local/man/{,**} r,
   /usr/local/share/man/{,**} r,
@@ -32,6 +29,9 @@ profile mandb @{exec_path} flags=(complain) {
 
   /usr/share/**/man/man@{u8}/*.@{int}.gz r,
 
+  owner /var/cache/man/ rw,
+  owner /var/cache/man/** rwk,
+
   owner @{user_share_dirs}/man/** rwk,
 
   include if exists <local/mandb>

apparmor.d/profiles-m-r/mimetype

@@ -13,7 +13,6 @@ profile mimetype @{exec_path} {
   include <abstractions/perl>
 
   @{exec_path} r,
-  /usr/bin/perl r,
 
   /usr/share/mime/**.xml r,
   /usr/share/mime/globs r,

apparmor.d/profiles-m-r/needrestart-notify

@@ -13,7 +13,7 @@ profile needrestart-notify @{exec_path} {
   capability dac_read_search,
   capability sys_ptrace,
 
-  ptrace read peer=unconfined,
+  ptrace read,
 
   @{exec_path} mr,
 

apparmor.d/profiles-m-r/pam-auth-update

@@ -14,8 +14,9 @@ profile pam-auth-update @{exec_path} flags=(complain) {
 
   @{exec_path} mrix,
 
-  @{bin}/md5sum  ix,
   @{bin}/cp      ix,
+  @{bin}/md5sum  ix,
+  @{bin}/stty    ix,
 
   /usr/share/pam{,-configs}/{,*} r,
 

apparmor.d/profiles-m-r/pcscd

@@ -16,13 +16,13 @@ profile pcscd @{exec_path} {
 
   network netlink raw,
 
-  ptrace (read) peer=@{p_systemd_user},
-  ptrace (read) peer=gsd-smartcard,
-  ptrace (read) peer=keepassxc,
-  ptrace (read) peer=pkcs11-register,
-  ptrace (read) peer=rngd,
-  ptrace (read) peer=scdaemon,
-  ptrace (read) peer=veracrypt,
+  ptrace read peer=@{p_systemd_user},
+  ptrace read peer=gsd-smartcard,
+  ptrace read peer=keepassxc,
+  ptrace read peer=pkcs11-register,
+  ptrace read peer=rngd,
+  ptrace read peer=scdaemon,
+  ptrace read peer=veracrypt,
 
   @{exec_path} mr,