feat(profiles): general update.

apparmor.d/groups/pacman/pacman

@@ -57,6 +57,7 @@ profile pacman @{exec_path} {
   /{usr/,}bin/cat                         rix,
   /{usr/,}bin/chgrp                       rix,
   /{usr/,}bin/chmod                       rix,
+  /{usr/,}bin/cp                          rix,
   /{usr/,}bin/dot                         rix,
   /{usr/,}bin/env                         rix,
   /{usr/,}bin/filecap                     rix,
@@ -72,7 +73,7 @@ profile pacman @{exec_path} {
   /{usr/,}bin/ln                          rix,
   /{usr/,}bin/perl                        rix,
   /{usr/,}bin/pkill                       rix,
-  /{usr/,}bin/cp                          rix,
+  /{usr/,}bin/pwd                         rix,
   /{usr/,}bin/rm                          rix,
   /{usr/,}bin/sed                         rix,
   /{usr/,}bin/setcap                      rix,
@@ -88,6 +89,7 @@ profile pacman @{exec_path} {
   /{usr/,}bin/dconf                       rPx,
   /{usr/,}bin/fc-cache{,-32}              rPx,
   /{usr/,}bin/gdk-pixbuf-query-loaders    rPx,
+  /{usr/,}bin/gio-querymodules            rPx,
   /{usr/,}bin/glib-compile-schemas        rPx,
   /{usr/,}bin/groupadd                    rPx,
   /{usr/,}bin/gtk-query-immodules-{2,3}.0 rPx,
@@ -107,7 +109,10 @@ profile pacman @{exec_path} {
   /{usr/,}bin/update-mime-database        rPx,
   /{usr/,}lib/systemd/systemd-*           rPx,
   /{usr/,}lib/vlc/vlc-cache-gen           rPx,
+  /opt/Mullvad*/resources/mullvad-setup   rPx,
+  /usr/share/code-features/patch.sh       rPx,
   /usr/share/libalpm/scripts/*           rPUx,
+  /usr/share/texmf-dist/scripts/texlive/mktexlsr rPUx,
 
   # Install/update packages
   / r,

apparmor.d/groups/pacman/pacman-hook-code

@@ -0,0 +1,24 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /usr/share/code-features/patch.sh
+profile pacman-hook-code @{exec_path} {
+  include <abstractions/base>
+
+  capability dac_read_search,
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/{,ba}sh     rix,
+  /{usr/,}bin/sed         rix,
+  /{usr/,}bin/grep        rix,
+
+  /{usr/,}lib/code/sed?????? rw,
+
+  include if exists <local/pacman-hook-code>
+}

apparmor.d/groups/systemd/systemd-fsck

@@ -19,8 +19,9 @@ profile systemd-fsck @{exec_path} {
 
   @{exec_path} mr,
 
-  /{usr/,}{s,}bin/fsck   rPx,
   /{usr/,}{s,}bin/e2fsck rPx,
+  /{usr/,}{s,}bin/fsck   rPx,
+  /{usr/,}{s,}bin/fsck.* rPx,
 
   owner @{run}/systemd/quotacheck w,
   owner @{run}/systemd/fsck.progress rw,

apparmor.d/groups/ubuntu/software-properties-gtk

@@ -68,8 +68,6 @@ profile software-properties-gtk @{exec_path} {
   /var/lib/snapd/desktop/icons/ r,
   /var/lib/ubuntu-advantage/status.json r,
 
-  owner @{run}/user/@{uid}/wayland-[0-9]* rw,
-
   owner /tmp/[a-z0-9]* rw,
   owner /tmp/tmp*/{,apt.conf} rw,