Revert "tty and pts are part of abstractions/consoles"

This reverts commit 51a33f3f5e.
2022-08-19 20:05:15 +02:00 · 2022-08-19 20:05:15 +02:00 · af603fbc62
commit af603fbc62
parent 35087ea4bb
59 changed files with 65 additions and 56 deletions
--- a/apparmor.d/groups/apps/usr.lib.libreoffice.program.soffice.bin
+++ b/apparmor.d/groups/apps/usr.lib.libreoffice.program.soffice.bin
@ -81,7 +81,6 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp

  #include <abstractions/audio>
  #include <abstractions/bash>
-  #include <abstractions/consoles>
  #include <abstractions/cups-client>
  #include <abstractions/dbus>
  #include <abstractions/dbus-session>
@ -152,6 +151,8 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
  /usr/bin/kgpg                         rix,
  /usr/bin/kleopatra                    rix,

+  /dev/tty                              rw,
+
  /usr/lib{,32,64}/@{multiarch}/gstreamer???/gstreamer-???/gst-plugin-scanner   rmPUx,
  owner @{user_cache_dirs}/gstreamer-???/**                                 rw,
  unix peer=(addr=@/tmp/.ICE-unix/* label=unconfined),  #Gstreamer doesn't work without this
--- a/apparmor.d/groups/apt/apt-mark
+++ b/apparmor.d/groups/apt/apt-mark
@ -10,7 +10,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/apt-mark
 profile apt-mark @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/apt-common>

  @{exec_path} mr,
@ -26,5 +25,7 @@ profile apt-mark @{exec_path} {
  /var/cache/apt/ r,
  /var/cache/apt/** rwk,

+  /dev/pts/[0-9]* rw,
+
  include if exists <local/apt-mark>
 }
--- a/apparmor.d/groups/bus/dbus-run-session
+++ b/apparmor.d/groups/bus/dbus-run-session
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/dbus-run-session
 profile dbus-run-session @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/dconf-write>

  signal (receive) set=(term, kill, hup) peer=gdm*,
@ -32,6 +31,9 @@ profile dbus-run-session @{exec_path} {

  owner @{PROC}/@{pid}/fd/ r,

+  # file_inherit
+  /dev/tty rw,
+  /dev/tty[0-9]* rw,

  include if exists <local/dbus-run-session>
 }
--- a/apparmor.d/groups/freedesktop/fc-cache
+++ b/apparmor.d/groups/freedesktop/fc-cache
@ -10,7 +10,6 @@ include <tunables/global>
@{exec_path} = /{snap/snapd/[0-9]*/,}{usr/,}bin/fc-cache{,-32,-v*}
 profile fc-cache @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/fonts>
  include <abstractions/fontconfig-cache-write>

--- a/apparmor.d/groups/freedesktop/plymouth
+++ b/apparmor.d/groups/freedesktop/plymouth
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/plymouth
 profile plymouth @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>

  unix (send, receive, connect) type=stream peer=(addr="@/org/freedesktop/plymouthd"),

--- a/apparmor.d/groups/freedesktop/xdg-mime
+++ b/apparmor.d/groups/freedesktop/xdg-mime
@ -10,7 +10,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/xdg-mime
 profile xdg-mime @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/freedesktop.org>

  @{exec_path} r,
@ -48,6 +47,7 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) {
  @{sys}/devices/platform/**/hwmon/hwmon[0-9]*/fan* r,

  /dev/dri/card[0-9]* rw,
+  /dev/tty rw,

  # When xdg-mime is run as root, it wants to exec dbus-launch, and hence it creates the two
  # following root processes:
--- a/apparmor.d/groups/freedesktop/xdg-open
+++ b/apparmor.d/groups/freedesktop/xdg-open
@ -50,6 +50,7 @@ profile xdg-open @{exec_path} flags=(attach_disconnected) {

  # file_inherit
  /dev/dri/card[0-9]* rw,
+  /dev/tty rw,

  profile dbus {
    include <abstractions/base>
--- a/apparmor.d/groups/freedesktop/xkbcomp
+++ b/apparmor.d/groups/freedesktop/xkbcomp
@ -10,7 +10,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/xkbcomp
 profile xkbcomp @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
-  include <abstractions/consoles>

  unix (connect, receive, send) type=stream peer=(addr="@/tmp/.X11-unix/X[0-9]*"),
  unix (send,receive) type=stream addr=none peer=(label=gnome-shell),
@ -33,6 +32,7 @@ profile xkbcomp @{exec_path} flags=(attach_disconnected) {
  owner /tmp/server-[0-9]*.xkm rwk,

  /dev/dri/card[0-9]* rw,
+  /dev/tty rw,
  /dev/tty[0-9]* rw,
  
  deny /dev/input/event[0-9]* rw,
--- a/apparmor.d/groups/freedesktop/xorg
+++ b/apparmor.d/groups/freedesktop/xorg
@ -13,7 +13,6 @@ include <tunables/global>
@{exec_path} += /{usr/,}lib/xorg/Xorg{,.wrap}
 profile xorg @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/dbus-strict>
  include <abstractions/fontconfig-cache-read>
  include <abstractions/fonts>
@ -132,6 +131,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
  /dev/input/event[0-9]* rw,
  /dev/shm/#[0-9]*[0-9] rw,
  /dev/shm/shmfd-* rw,
+  /dev/tty rw,
  /dev/tty[0-9]* rw,
  /dev/vga_arbiter rw,  # Graphic card modules

--- a/apparmor.d/groups/freedesktop/xwayland
+++ b/apparmor.d/groups/freedesktop/xwayland
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path}  = /{usr/,}bin/Xwayland
 profile xwayland @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/dri-common>
  include <abstractions/dri-enumerate>
  include <abstractions/mesa>
@ -42,6 +41,7 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
  owner @{PROC}/@{pids}/comm r,

  /dev/tty[0-9]* rw,
+  /dev/tty rw,

  include if exists <local/xwayland>
 }
--- a/apparmor.d/groups/gnome/gdm-session-worker
+++ b/apparmor.d/groups/gnome/gdm-session-worker
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = @{libexec}/gdm-session-worker
 profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/authentication>
  include <abstractions/dbus-session-strict>
  include <abstractions/dbus-strict>
@ -88,6 +87,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
        @{PROC}/1/limits r,
        @{PROC}/keys r,

+  /dev/tty rw,
  /dev/tty[0-9]* rw,

  include if exists <local/gdm-session-worker>
--- a/apparmor.d/groups/gnome/gdm-xsession
+++ b/apparmor.d/groups/gnome/gdm-xsession
@ -43,6 +43,7 @@ profile gdm-xsession @{exec_path} {
    /{usr/,}bin/dbus-update-activation-environment mr,

    # file_inherit
+    /dev/tty rw,
    /dev/tty[0-9]* rw,
    owner @{HOME}/.xsession-errors w,
  }
--- a/apparmor.d/groups/gnome/gjs-console
+++ b/apparmor.d/groups/gnome/gjs-console
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path}  = /{usr/,}bin/gjs-console
 profile gjs-console @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/dbus-session-strict>
  include <abstractions/dconf-write>
  include <abstractions/dri-common>
@ -59,6 +58,7 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
  owner @{PROC}/@{pid}/stat r,

  /dev/ r,
+  /dev/tty rw,
  /dev/tty[0-9]* rw,

  include if exists <local/gjs-console>
--- a/apparmor.d/groups/gnome/gnome-extensions-app
+++ b/apparmor.d/groups/gnome/gnome-extensions-app
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/gnome-extensions-app
 profile gnome-extensions-app @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>

  @{exec_path} mr,

@ -18,6 +17,7 @@ profile gnome-extensions-app @{exec_path} {

  /usr/share/terminfo/x/xterm-256color r,

+  /dev/tty rw,

  include if exists <local/gnome-extensions-app>
 }
--- a/apparmor.d/groups/gnome/gnome-session-binary
+++ b/apparmor.d/groups/gnome/gnome-session-binary
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = @{libexec}/gnome-session-binary
 profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/dbus-session-strict>
  include <abstractions/dbus-strict>
  include <abstractions/dconf-write>
@ -142,6 +141,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
        @{PROC}/@{pid}/cgroup r,
        @{PROC}/cmdline r,

+  /dev/tty rw,
  /dev/tty[0-9]* rw,

  include if exists <usr/gnome-session-binary.d>
--- a/apparmor.d/groups/gnome/gsd-xsettings
+++ b/apparmor.d/groups/gnome/gsd-xsettings
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = @{libexec}/gsd-xsettings
 profile gsd-xsettings @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/dbus-session-strict>
  include <abstractions/dbus-strict>
  include <abstractions/dconf-write>
@ -71,6 +70,7 @@ profile gsd-xsettings @{exec_path} {

  owner @{PROC}/@{pid}/fd/ r,

+  /dev/tty rw,
  /dev/tty[0-9]* rw,

  profile run-parts {
--- a/apparmor.d/groups/gnome/nautilus
+++ b/apparmor.d/groups/gnome/nautilus
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/nautilus
 profile nautilus @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/app-launcher-user>
  include <abstractions/dbus-strict>
  include <abstractions/dconf-write>
@ -62,6 +61,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
  owner @{PROC}/@{pid}/mountinfo r,
        @{PROC}/@{pids}/net/wireless r,

+  /dev/tty rw,
  /dev/dri/card[0-9]* rw,

  include if exists <local/nautilus>
--- a/apparmor.d/groups/network/mullvad-gui
+++ b/apparmor.d/groups/network/mullvad-gui
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = "/opt/Mullvad VPN/mullvad-gui"
 profile mullvad-gui @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/chromium-common>
  include <abstractions/dconf-write>
  include <abstractions/dri-common>
@ -70,6 +69,7 @@ profile mullvad-gui @{exec_path} {
  owner @{PROC}/@{pid}/task/@{tid}/status r,
  owner @{PROC}/@{pid}/uid_map w,

+  /dev/tty rw,

  include if exists <local/mullvad-gui>
 }
--- a/apparmor.d/groups/network/nm-openvpn-service
+++ b/apparmor.d/groups/network/nm-openvpn-service
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/nm-openvpn-service
 profile nm-openvpn-service @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/nameservice-strict>

  capability kill,
@ -28,6 +27,7 @@ profile nm-openvpn-service @{exec_path} {
  @{run}/NetworkManager/nm-openvpn-@{uuid} rw,

  /dev/net/tun rw,
+  /dev/tty rw,

  owner @{PROC}/@{pid}/fd/ r,

--- a/apparmor.d/groups/network/wg-quick
+++ b/apparmor.d/groups/network/wg-quick
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/wg-quick
 profile wg-quick @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>

  capability net_admin,

@ -40,6 +39,7 @@ profile wg-quick @{exec_path} {

  @{PROC}/sys/net/ipv4/conf/all/src_valid_mark w,

+  /dev/tty rw,

  # Force the use as root
  deny /{usr/,}bin/sudo x,
--- a/apparmor.d/groups/pacman/archlinux-java
+++ b/apparmor.d/groups/pacman/archlinux-java
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/archlinux-java
 profile archlinux-java @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>

  capability dac_read_search,

@ -26,6 +25,7 @@ profile archlinux-java @{exec_path} {
  /{usr/,}lib/jvm/default w,
  /{usr/,}lib/jvm/default-runtime w,

+  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/paccache
+++ b/apparmor.d/groups/pacman/paccache
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/paccache
 profile paccache @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/nameservice-strict>

  capability dac_read_search,
@ -36,6 +35,7 @@ profile paccache @{exec_path} {

  owner @{PROC}/@{pid}/fd/ r,

+  /dev/tty rw,

  include if exists <local/paccache>
 }
--- a/apparmor.d/groups/pacman/pacdiff
+++ b/apparmor.d/groups/pacman/pacdiff
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/pacdiff
 profile pacdiff @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
-  include <abstractions/consoles>

  capability dac_read_search,
  capability mknod,
@ -37,6 +36,7 @@ profile pacdiff @{exec_path} flags=(attach_disconnected) {
  /usr/{,**} r,
  /var/{,**} r,

+  /dev/tty rw,

  # Inherit Silencer
  deny /apparmor/.null rw,
--- a/apparmor.d/groups/pacman/pacman-hook-dconf
+++ b/apparmor.d/groups/pacman/pacman-hook-dconf
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/dconf-update
 profile pacman-hook-dconf @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>

  capability dac_read_search,

@ -21,6 +20,7 @@ profile pacman-hook-dconf @{exec_path} {

  /etc/dconf/db/{,**} rw,

+  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-depmod
+++ b/apparmor.d/groups/pacman/pacman-hook-depmod
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/depmod
 profile pacman-hook-depmod @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>

  capability dac_read_search,

@ -24,6 +23,7 @@ profile pacman-hook-depmod @{exec_path} {

  /usr/lib/modules/*/{,**} rw,

+  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-dkms
+++ b/apparmor.d/groups/pacman/pacman-hook-dkms
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/dkms
 profile pacman-hook-dkms @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>

  capability dac_read_search,
  capability mknod,
@ -28,6 +27,7 @@ profile pacman-hook-dkms @{exec_path} {

  /etc/dkms/{,*} r,

+  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-fontconfig
+++ b/apparmor.d/groups/pacman/pacman-hook-fontconfig
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/40-fontconfig-config
 profile pacman-hook-fontconfig @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>

  capability dac_read_search,

@ -22,6 +21,7 @@ profile pacman-hook-fontconfig @{exec_path} {
  /etc/fonts/conf.d/* rwl,
  /usr/share/fontconfig/conf.default/* r,

+  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-gio
+++ b/apparmor.d/groups/pacman/pacman-hook-gio
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/gio-querymodules
 profile pacman-hook-gio @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>

  capability dac_read_search,

@ -24,6 +23,7 @@ profile pacman-hook-gio @{exec_path} {

  /usr/lib/gio/modules/ rw,

+  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-gtk
+++ b/apparmor.d/groups/pacman/pacman-hook-gtk
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/gtk-update-icon-cache
 profile pacman-hook-gtk @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>

  capability dac_read_search,

@ -24,6 +23,7 @@ profile pacman-hook-gtk @{exec_path} {

  /usr/share/icons/{,**} rw,

+  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-install
+++ b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-install
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/mkinitcpio-install
 profile pacman-hook-mkinitcpio-install @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
-  include <abstractions/consoles>

  capability dac_read_search,
  capability mknod,
@ -33,6 +32,7 @@ profile pacman-hook-mkinitcpio-install @{exec_path} flags=(attach_disconnected)
  / r,
  owner /boot/vmlinuz-* rw,

+  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove
+++ b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/mkinitcpio-remove
 profile pacman-hook-mkinitcpio-remove @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>

  capability dac_read_search,
  capability mknod,
@ -29,6 +28,7 @@ profile pacman-hook-mkinitcpio-remove @{exec_path} {
  /boot/initramfs-*.img rw,
  /boot/initramfs-*-fallback.img rw,

+  /dev/tty rw,

  # Inherit Silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-perl
+++ b/apparmor.d/groups/pacman/pacman-hook-perl
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/detect-old-perl-modules.sh
 profile pacman-hook-perl @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>

  capability dac_read_search,
  capability mknod,
@ -24,6 +23,7 @@ profile pacman-hook-perl @{exec_path} {

  /{usr/,}lib/perl[0-9]*/{,**} r,

+  /dev/tty rw,

  # Inherit silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-hook-systemd
+++ b/apparmor.d/groups/pacman/pacman-hook-systemd
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/systemd-hook
 profile pacman-hook-systemd @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>

  capability dac_read_search,

@ -30,6 +29,7 @@ profile pacman-hook-systemd @{exec_path} {

  /usr/ rw,

+  /dev/tty rw,

  # Inherit silencer
  deny network inet6 stream,
--- a/apparmor.d/groups/pacman/pacman-key
+++ b/apparmor.d/groups/pacman/pacman-key
@ -35,6 +35,7 @@ profile pacman-key @{exec_path} {

  /etc/pacman.d/gnupg/gpg.conf r,

+  /dev/tty rw,

  profile gpg {
    include <abstractions/base>
--- a/apparmor.d/groups/systemd/systemd-analyze
+++ b/apparmor.d/groups/systemd/systemd-analyze
@ -10,7 +10,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/systemd-analyze
 profile systemd-analyze @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/dbus-strict>
  include <abstractions/systemd-common>

@ -74,5 +73,8 @@ profile systemd-analyze @{exec_path} {
  owner @{PROC}/@{pid}/comm r,
        @{PROC}/swaps r,

+  /dev/tty rw,
+  /dev/pts/1 rw,
+
  include if exists <local/systemd-analyze>
 }
--- a/apparmor.d/groups/systemd/systemd-environment-d-generator
+++ b/apparmor.d/groups/systemd/systemd-environment-d-generator
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/user-environment-generators/*
 profile systemd-environment-d-generator @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/systemd-common>
  include <abstractions/nameservice-strict>

@ -25,6 +24,7 @@ profile systemd-environment-d-generator @{exec_path} {

  owner @{user_config_dirs}/environment.d/{,*.conf} r,

+  /dev/tty rw,

  include if exists <local/systemd-environment-d-generator>
 }
--- a/apparmor.d/groups/systemd/systemd-sleep
+++ b/apparmor.d/groups/systemd/systemd-sleep
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/systemd-sleep
 profile systemd-sleep @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/nameservice-strict>
  include <abstractions/systemd-common>

@ -30,6 +29,7 @@ profile systemd-sleep @{exec_path} {

  @{PROC}/driver/nvidia/suspend w,

+  /dev/tty rw,

  include if exists <local/systemd-sleep>
 }
--- a/apparmor.d/groups/virt/k3s
+++ b/apparmor.d/groups/virt/k3s
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}{local/,}bin/k3s
 profile k3s @{exec_path} {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/disks-read>
  include <abstractions/nameservice-strict>
  include <abstractions/ssl_certs>
@ -168,6 +167,7 @@ profile k3s @{exec_path} {
  @{sys}/module/apparmor/parameters/enabled r,

  /dev/kmsg r,
+  /dev/pts/[0-9]* rw,

  include if exists <local/k3s>
 }