Profile update.

apparmor.d/groups/systemd/systemd-binfmt

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}lib/systemd/systemd-binfmt
-profile systemd-binfmt @{exec_path} {
+profile systemd-binfmt @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
 
   capability net_admin,
@@ -28,5 +28,7 @@ profile systemd-binfmt @{exec_path} {
         @{PROC}/sys/fs/binfmt_misc/register w,
         @{PROC}/sys/kernel/osrelease r,
 
+  deny /apparmor/.null rw,
+
   include if exists <local/systemd-binfmt>
 }

apparmor.d/groups/systemd/systemd-modules-load

@@ -11,6 +11,7 @@ profile systemd-modules-load @{exec_path} {
   include <abstractions/base>
   include <abstractions/systemd-common>
 
+  capability net_admin,
   capability sys_module,
 
   @{exec_path} mr,