Profiles update.

apparmor.d/groups/systemd/child-systemctl

@@ -23,6 +23,9 @@ profile child-systemctl {
 
   ptrace (read),
 
+  network inet stream,
+  network inet6 stream,
+
   /{usr/,}bin/systemctl mr,
 
   owner @{PROC}/@{pid}/stat r,

apparmor.d/groups/systemd/systemd-coredump

@@ -10,29 +10,30 @@ include <tunables/global>
 @{exec_path}  = /{usr/,}lib/systemd/systemd-coredump
 profile systemd-coredump @{exec_path} flags=(attach_disconnected complain) {
   include <abstractions/base>
+  include <abstractions/nameservice-strict>
   include <abstractions/openssl>
   include <abstractions/systemd-common>
-  include <abstractions/nameservice-strict>
 
+  capability dac_read_search,
+  capability setgid,
   capability setpcap,
   capability setuid,
-  capability setgid,
-  capability dac_read_search,
   capability sys_ptrace,
   # Needed?
-  deny capability net_admin,
+  # deny capability net_admin,
 
   @{exec_path} mr,
 
   /{usr/,}bin/* r,
   /{usr/,}sbin/* r,
-  /usr/libexec/** r,
+  /usr/{lib,libexec}/** r,
 
   /etc/systemd/coredump.conf r,
 
-        /var/lib/systemd/coredump/ r,
-  owner /var/lib/systemd/coredump/#[0-9]* rw,
-  owner /var/lib/systemd/coredump/core.*.[0-9]*.[0-9a-f]*.[0-9]*.[0-9]*{,.zst} rwl -> /var/lib/systemd/coredump/#[0-9]*,
+  /var/lib/systemd/coredump/ r,
+  /var/lib/systemd/coredump/#[0-9]* rwl,
+  /var/lib/systemd/coredump/core.*.@{uid}.[0-9a-f]*.[0-9]*.[0-9]*.zst rwl,
+  /var/lib/systemd/coredump/core.*.@{uid}.[0-9a-f]*.[0-9]*.[0-9]* rwl,
 
   owner @{PROC}/@{pid}/setgroups r,
         @{PROC}/@{pids}/comm r,

apparmor.d/groups/systemd/systemd-detect-virt

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2020-2021 Mikhail Morfikov
+#               2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -19,5 +20,9 @@ profile systemd-detect-virt @{exec_path} {
   @{sys}/devices/virtual/dmi/id/board_vendor r,
   @{sys}/devices/virtual/dmi/id/bios_vendor r,
 
+  # Silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
   include if exists <local/systemd-detect-virt>
 }

apparmor.d/groups/systemd/systemd-sysusers

@@ -37,5 +37,9 @@ profile systemd-sysusers @{exec_path} {
   owner @{PROC}/@{pid}/stat r,
         @{PROC}/sys/kernel/random/boot_id r,
 
+  # Silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
   include if exists <local/systemd-sysusers>
 }

apparmor.d/groups/systemd/systemd-tmpfiles

@@ -48,5 +48,9 @@ profile systemd-tmpfiles @{exec_path} {
 
   @{PROC}/@{pid}/net/unix r,
 
+  # Silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
   include if exists <local/systemd-tmpfiles>
 }

apparmor.d/groups/systemd/systemd-udevd

@@ -91,5 +91,9 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
   # file_inherit
   owner @{HOME}/.xsession-errors w,
 
+  # Silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
   include if exists <local/systemd-udevd>
 }