Various updates (#209)

apparmor.d/groups/grub/grub-mkconfig

@@ -8,7 +8,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = @{bin}/grub-mkconfig
-profile grub-mkconfig @{exec_path} {
+profile grub-mkconfig @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
 
@@ -44,6 +44,7 @@ profile grub-mkconfig @{exec_path} {
   @{bin}/mktemp               rix,
   @{bin}/mount                rPx,
   @{bin}/mountpoint           rix,
+  @{bin}/mv                   rix,
   @{bin}/os-prober            rPx,
   @{bin}/paste                rix,
   @{bin}/readlink             rix,
@@ -59,6 +60,10 @@ profile grub-mkconfig @{exec_path} {
   @{bin}/which{.debianutils,} rix,
   /etc/grub.d/{**,}           rix,
 
+  @{lib}/gconv/gconv-modules r,
+  @{lib}/gconv/gconv-modules.d/{,gconv-modules-extra.conf} r,
+  @{lib}/libostree/grub[0-9]-@{int}_ostree rix,
+
   /boot/{**,} r,
   /boot/grub/{**,} rw,
 
@@ -67,7 +72,7 @@ profile grub-mkconfig @{exec_path} {
   /etc/default/grub.d/{*,} r,
 
   /usr/share/grub/{**,} r,
-  /usr/share/terminfo/x/xterm-256color r,
+  /usr/share/terminfo/{,x/xterm-256color} r,
 
   /.zfs/snapshot/*/boot/ r,
   /.zfs/snapshot/*/etc/{machine-id,} r,
@@ -83,5 +88,7 @@ profile grub-mkconfig @{exec_path} {
 
   @{sys}/firmware/efi/efivars/OsIndicationsSupported-@{uuid} r,
 
+  /dev/tty@{int} rw,
+
   include if exists <local/grub-mkconfig>
 }

apparmor.d/groups/systemd/systemd-udevd

@@ -48,6 +48,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
   @{bin}/lvm               rPx,
   @{bin}/mknod             rPx,
   @{bin}/multipath         rPx,
+  @{bin}/nfsrahead         rix,
   @{bin}/nohup             rix,
   @{bin}/perl              rix,
   @{bin}/readlink          rix,
@@ -76,6 +77,8 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
 
   /etc/default/* r,
 
+  /etc/nfs.conf rk,
+
   /etc/udev/ r,
   /etc/udev/udev.conf r,
   /etc/udev/rules.d/ r,
@@ -108,6 +111,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
         @{PROC}/driver/nvidia/gpus/*/information r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/loginuid r,
+        @{PROC}/@{pid}/mountinfo r,
   owner @{PROC}/@{pid}/oom_score_adj rw,
 
   /dev/ rw,