feat(profiles): general update.

apparmor.d/profiles-s-z/sysctl

@@ -2,6 +2,8 @@
 # Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
+# TODO: Rethink this profile. Should not be called by another profile.
+
 abi <abi/3.0>,
 
 include <tunables/global>

apparmor.d/profiles-s-z/uname

@@ -13,10 +13,9 @@ profile uname @{exec_path} {
 
   @{exec_path} mr,
 
-  owner /tmp/mktexlsr.* rw,
-
   # file_inherit
   owner @{HOME}/.xsession-errors w,
+  owner /tmp/mktexlsr.* rw,
 
   deny @{user_share_dirs}/gvfs-metadata/* r,
 

apparmor.d/profiles-s-z/userdel

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -12,21 +13,13 @@ profile userdel @{exec_path} flags=(attach_disconnected) {
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
 
-  # The userdel command is issued as root and its task is to delete regular user accounts. It
-  # optionally can remove user files (via --remove). Because of that, the userdel command needs the
-  # following CAPs to be able to do so.
-  capability dac_read_search,
-  capability dac_override,
-
-  # To write records to the kernel auditing log.
   capability audit_write,
-
-  # To set the right permission to the files in the /etc/ dir).
   capability chown,
+  capability dac_override,
+  capability dac_read_search,
   capability fsetid,
-
-  # To prevent removing a user when it's used by some process.
   capability sys_ptrace,
+
   ptrace (read),
 
   network netlink raw,
@@ -35,9 +28,6 @@ profile userdel @{exec_path} flags=(attach_disconnected) {
 
   /etc/login.defs r,
 
-  @{PROC}/ r,
-  @{PROC}/@{pids}/task/ r,
-
   /etc/{passwd,shadow,gshadow,group,subuid,subgid} rw,
   /etc/{passwd,shadow,gshadow,group,subuid,subgid}.@{pid} w,
   /etc/{passwd,shadow,gshadow,group,subuid,subgid}- w,
@@ -60,5 +50,8 @@ profile userdel @{exec_path} flags=(attach_disconnected) {
   /var/lib/        r,
   /var/lib/*/{,**} rw,
 
+  @{PROC}/ r,
+  @{PROC}/@{pids}/task/ r,
+
   include if exists <local/userdel>
 }