feat(profile): general update.

apparmor.d/groups/network/wg

@@ -11,11 +11,18 @@ profile wg @{exec_path} {
   include <abstractions/base>
 
   capability net_admin,
+  capability net_bind_service,
 
+  network inet dgram,
+  network inet stream,
+  network inet6 dgram,
+  network inet6 stream,
   network netlink raw,
 
   @{exec_path} mr,
 
+  /etc/wireguard/{,**} rw,
+
   include if exists <local/wg>
 }
 

apparmor.d/groups/network/wg-quick

@@ -10,6 +10,7 @@ include <tunables/global>
 profile wg-quick @{exec_path} {
   include <abstractions/base>
 
+  capability dac_read_search,
   capability net_admin,
 
   network netlink raw,
@@ -21,7 +22,8 @@ profile wg-quick @{exec_path} {
   @{bin}/ip                 rPx,
   @{bin}/nft                rix,
   @{bin}/readlink           rix,
-  @{bin}/resolvectl         rPx,
+  @{bin}/resolvconf         rPx,
+  @{bin}/resolvectl        rPUx,
   @{bin}/sort               rix,
   @{bin}/stat               rix,
   @{bin}/sysctl             rix,