feat(profile): general update.

apparmor.d/profiles-s-z/snap-seccomp

@@ -20,6 +20,8 @@ profile snap-seccomp @{exec_path} {
 
   @{lib_dirs}/**.so* mr,
 
+  @{bin}/getent rix,
+
   /var/lib/snapd/seccomp/bpf/{,**} rw,
 
   owner @{PROC}/@{pids}/mountinfo r,

apparmor.d/profiles-s-z/spotify

@@ -26,6 +26,7 @@ profile spotify @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mrix,
 
+  @{sh_path} mr,
   @{bin}/grep rix,
 
   @{open_path}     rPx -> child-open-strict,
@@ -44,6 +45,7 @@ profile spotify @{exec_path} flags=(attach_disconnected) {
   owner @{tmp}/.org.chromium.Chromium.@{rand6}/** rw,
 
         @{PROC}/pressure/* r,
+        @{PROC}/@{pid}/net/unix r,
   owner @{PROC}/@{pid}/clear_refs w,
 
   /dev/tty rw,

apparmor.d/profiles-s-z/steam-game-proton

@@ -76,6 +76,7 @@ profile steam-game-proton @{exec_path} flags=(attach_disconnected,complain) {
 
   owner @{share_dirs}/*.dll r,
   owner @{share_dirs}/bin/ r,
+  owner @{share_dirs}/installscriptevalutor_log.txt rw,
   owner @{share_dirs}/legacycompat/ r,
   owner @{share_dirs}/legacycompat/** mr,
   owner @{share_dirs}/steamapps/compatdata/{,**} rwk,

apparmor.d/profiles-s-z/tlp

@@ -45,7 +45,7 @@ profile tlp @{exec_path} flags=(attach_disconnected) {
   @{bin}/readlink               rix,
   @{bin}/rm                     rix,
   @{bin}/sort                   rix,
-  @{bin}/systemctl              rCx ->  systemctl,
+  @{bin}/systemctl              rCx -> systemctl,
   @{bin}/touch                  rix,
   @{bin}/tr                     rix,
   @{bin}/udevadm                rCx -> udevadm,
@@ -63,30 +63,33 @@ profile tlp @{exec_path} flags=(attach_disconnected) {
   /var/lib/tlp/{,**} rw,
   /var/lib/power-profiles-daemon/state.ini rw,
 
+  owner /tmp/tlp-run.conf_tmp@{rand6} rw,
+
   owner @{run}/tlp/{,**} rw,
   owner @{run}/tlp/lock_tlp  rwk,
 
   @{run}/udev/data/+platform:* r,
 
+  @{sys}/bus/pci/devices/ r,
+  @{sys}/devices/@{pci}/{,**/}power/control w,
   @{sys}/devices/system/cpu/cpufreq/policy@{int}/energy_performance_preference rw,
-  @{sys}/module/pcie_aspm/parameters/policy rw,
-  @{sys}/module/snd_hda_intel/parameters/power_save rw,
-  @{sys}/module/snd_hda_intel/parameters/power_save_controller rw,
   @{sys}/firmware/acpi/platform_profile* rw,
   @{sys}/firmware/acpi/pm_profile* rw,
+  @{sys}/module/*/parameters/power_save rw,
+  @{sys}/module/*/parameters/power_save_controller rw,
+  @{sys}/module/pcie_aspm/parameters/policy rw,
 
   owner @{PROC}/sys/fs/xfs/xfssyncd_centisecs rw,
   owner @{PROC}/sys/kernel/nmi_watchdog rw,
   owner @{PROC}/sys/vm/dirty_*_centisecs rw,
   owner @{PROC}/sys/vm/laptop_mode rw,
 
-  /dev/disk/by-id/ r,
-  /dev/tty rw,
-
   profile systemctl {
     include <abstractions/base>
     include <abstractions/app/systemctl>
 
+    capability net_admin,
+
     include if exists <local/tlp_systemctl>
   }