Update various profiles

Signed-off-by: Jeroen Rijken <jeroen.rijken@xs4all.nl>

apparmor.d/groups/network/NetworkManager

@@ -50,6 +50,26 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
        member=GetManagedObjects
        peer=(name=:*),
 
+  dbus receive bus=system path=/
+       interface=org.freedesktop.DBus.ObjectManager
+       member=InterfacesRemoved
+       peer=(name=:*, label=bluetoothd),
+
+  dbus send bus=system path=/
+       interface=org.freedesktop.DBus.ObjectManager
+       member=GetManagedObjects
+       peer=(name=:*, label=bluetoothd),
+
+  dbus send bus=system path=/org/fedoraproject/FirewallD1
+       interface=org.fedoraproject.FirewallD1.zone
+       member={changeZoneOfInterface,removeInterface}
+       peer=(name=org.freedesktop.DBus, label=firewalld),
+
+  dbus send bus=system path=/org/freedesktop
+       interface=org.freedesktop.DBus.ObjectManager
+       member=InterfacesAdded
+       peer=(name=org.freedesktop.DBus, label=nm-online),
+
   dbus send bus=system path=/org/freedesktop/nm_dispatcher
        interface=org.freedesktop.nm_dispatcher
        member=Action

apparmor.d/groups/network/nm-dispatcher

@@ -26,11 +26,13 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
 
   @{sh_path}                rix,
   @{bin}/basename           rix,
+  @{bin}/cat                rix,
   @{bin}/chronyc           rPUx,
   @{bin}/date               rix,
   @{bin}/gawk               rix,
   @{bin}/grep               rix,
   @{bin}/id                 rix,
+  @{bin}/invoke-rc.d        rCx -> invoke-rc,
   @{bin}/mkdir              rix,
   @{bin}/mktemp             rix,
   @{bin}/netconfig         rPUx,
@@ -39,7 +41,7 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
   @{bin}/rm                 rix,
   @{bin}/run-parts          rCx -> run-parts,
   @{bin}/sed                rix,
-  @{bin}/systemctl          rix,
+  @{bin}/systemctl          rCx -> systemctl,
   @{bin}/systemd-cat        rPx,
   @{bin}/tr                 rix,
   /usr/share/tlp/tlp-readconfs  rPUx,
@@ -48,6 +50,7 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
   @{lib}/NetworkManager/dispatcher.d/** rix,
   /etc/NetworkManager/dispatcher.d/ r,
   /etc/NetworkManager/dispatcher.d/** rix,
+  /etc/dhcp/dhclient-exit-hooks.d/ntp r,
 
   /usr/share/tlp/{,**} rw,
 
@@ -57,6 +60,7 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
   @{run}/systemd/notify rw,
   @{run}/tlp/{,*} rw,
   @{run}/chrony-dhcp/ rw,
+  @{run}/ntp.conf.dhcp rw,
 
   @{sys}/class/net/ r,
 
@@ -64,6 +68,45 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
 
   /dev/tty rw,
 
+  profile systemctl {
+    include <abstractions/base>
+    include <abstractions/systemd-common>
+
+    @{bin}/systemctl mr,
+
+    / r,
+
+    @{etc_ro}/ r,
+    @{etc_ro}/systemd/ r,
+    @{etc_ro}/systemd/system/ r,
+    @{etc_ro}/systemd/system/ntp.service r,
+
+    owner @{run}/systemd/private rw,
+          @{run}/utmp k,
+
+    /dev r,
+
+    include if exists <local/nm-dispatcher_systemctl>
+  }
+
+  profile invoke-rc {
+    include <abstractions/base>
+
+    @{sh_path}       rix,
+    @{bin}/ls        rix,
+    @{bin}/systemctl rCx -> systemctl,
+
+    / r,
+
+    /etc/ r,
+    @{etc_ro}/rc{[0-9],S}.d/{,*} r,
+    @{etc_ro}/init.d/ntp r,
+
+    owner @{PROC}/filesystems r,
+
+    include if exists <local/nm-dispatcher_invoke-rc>
+  }
+
   profile run-parts {
     include <abstractions/base>