Profiles update.

apparmor.d/groups/pacman/archlinux-java

@@ -10,6 +10,8 @@ include <tunables/global>
 profile archlinux-java @{exec_path} {
   include <abstractions/base>
 
+  capability dac_read_search,
+
   @{exec_path} mr,
 
   /{usr/,}bin/basename  rix,
@@ -19,5 +21,11 @@ profile archlinux-java @{exec_path} {
   /{usr/,}bin/readlink  rix,
   /{usr/,}bin/unlink    rix,
 
+  /dev/tty rw,
+
+  # Inherit Silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
   include if exists <local/archlinux-java>
 }

apparmor.d/groups/pacman/pacman

@@ -139,6 +139,9 @@ profile pacman @{exec_path} {
 
     owner /etc/pacman.d/gnupg/ rw,
     owner /etc/pacman.d/gnupg/** rwkl,
+
+    deny network inet stream,
+    deny network inet6 stream,
   }
 
   include if exists <usr/pacman.d>

apparmor.d/groups/pacman/pacman-key

@@ -9,7 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}bin/pacman-key
 profile pacman-key @{exec_path} {
   include <abstractions/base>
-  
+
   capability dac_read_search,
   capability mknod,
 
@@ -29,7 +29,7 @@ profile pacman-key @{exec_path} {
   /{usr/,}bin/wc           rix,
 
   /usr/share/makepkg/{,**} r,
-  /usr/share/pacman/keyrings/* r,
+  /usr/share/pacman/keyrings/{,*} r,
   /usr/share/terminfo/x/xterm-256color r,
 
   /dev/tty rw,
@@ -47,11 +47,13 @@ profile pacman-key @{exec_path} {
     /{usr/,}bin/gpg        mr,
     /{usr/,}bin/gpg-agent  rix,
 
-    /usr/share/pacman/keyrings/* r,
+    /usr/share/pacman/keyrings/{,*} r,
 
     /etc/pacman.d/gnupg/ rw,
     /etc/pacman.d/gnupg/** rwkl,
 
+    @{HOME}/.gnupg/gpg.conf r,
+
     owner @{PROC}/@{pid}/fd/ r,
 
     # Inherit Silencer