feat(profile): revisit the gparted profiles

fix #697

apparmor.d/profiles-g-l/gparted

@@ -8,41 +8,35 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{exec_path} = @{bin}/gparted
-profile gparted @{exec_path} {
+profile gparted @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/consoles>
 
-  ptrace (read),
+  ptrace read,
 
   @{exec_path} r,
 
-  @{bin}/          r,
+  @{bin}/            r,
+  @{coreutils_path}  rix,
   @{sh_path}         rix,
-  @{bin}/{,e}grep    rix,
-  @{bin}/{m,g,}awk   rix,
-  @{bin}/cut         rix,
-  @{bin}/id          rix,
-  @{bin}/ls          rix,
-  @{bin}/mkdir       rix,
-  @{bin}/pidof       rix,
-  @{bin}/rm          rix,
-  @{bin}/sed         rix,
-  @{bin}/touch       rix,
+
+  @{bin}/killall5    rCx -> killall,
+  @{bin}/systemctl   rCx -> systemctl,
+  @{bin}/udevadm     rCx -> udevadm,
+
+  @{bin}/pidof       rPx,
+  @{bin}/pkexec      rPx,
+  @{bin}/ps          rPx,
+  @{bin}/xhost       rPx,
 
   @{bin}/gpartedbin          rPx,
   @{lib}/gparted/gpartedbin  rPx,
   @{lib}/gpartedbin          rPx,
 
   @{lib}/{,udisks2/}udisks2-inhibit  rix,
+
   @{run}/udev/rules.d/ rw,
-  @{run}/udev/rules.d/90-udisks-inhibit.rules rw,
-
-  @{bin}/udevadm       rCx -> udevadm,
-  @{bin}/killall5      rCx -> killall,
-
-  @{bin}/ps          rPx,
-  @{bin}/xhost       rPx,
-  @{bin}/pkexec      rPx,
-  @{bin}/systemctl   rCx -> systemctl,
+  @{run}/udev/rules.d/@{int}-*.rules rw,
 
   # For shell pwd
   / r,
@@ -57,7 +51,6 @@ profile gparted @{exec_path} {
   # file_inherit
   owner /dev/tty@{int} rw,
 
-
   profile udevadm {
     include <abstractions/base>
     include <abstractions/app/udevadm>
@@ -80,11 +73,9 @@ profile gparted @{exec_path} {
 
     @{bin}/killall5 mr,
 
-    # The /proc/ dir is needed to avoid the following error:
-    #  /proc: Permission denied
-         @{PROC}/ r,
-         @{PROC}/@{pids}/stat r,
-         @{PROC}/@{pids}/cmdline r,
+    @{PROC}/ r,
+    @{PROC}/@{pids}/stat r,
+    @{PROC}/@{pids}/cmdline r,
 
     include if exists <local/gparted_killall>
   }
@@ -93,6 +84,8 @@ profile gparted @{exec_path} {
     include <abstractions/base>
     include <abstractions/app/systemctl>
 
+    capability net_admin,
+
     include if exists <local/gparted_systemctl>
   }
 

apparmor.d/profiles-g-l/gpartedbin

@@ -14,7 +14,9 @@ profile gpartedbin @{exec_path} {
   include <abstractions/desktop>
   include <abstractions/disks-write>
   include <abstractions/fontconfig-cache-read>
+  include <abstractions/nameservice-strict>
 
+  capability dac_override,
   capability dac_read_search,
   capability ipc_lock,
   capability sys_admin,
@@ -44,12 +46,11 @@ profile gpartedbin @{exec_path} {
   @{bin}/dumpe2fs   rPx,
   @{bin}/e2fsck     rPx,
   @{bin}/e2image    rPx,
-  @{bin}/fsck.btrfs rPx,
-  @{bin}/fsck.fat   rPx,
+  @{bin}/fsck.*     rPUx,
   @{bin}/lvm        rPUx,
   @{bin}/mdadm      rPUx,
   @{bin}/mke2fs     rPx,
-  @{bin}/mkfs.*     rPx,
+  @{bin}/mkfs.*     rPUx,
   @{bin}/mkntfs     rPx,
   @{bin}/mkswap     rPx,
   @{bin}/mtools     rPx,
@@ -60,11 +61,14 @@ profile gpartedbin @{exec_path} {
   @{bin}/swaplabel  rPx,
   @{bin}/swapoff    rPx,
   @{bin}/swapon     rPx,
+  @{bin}/tune.*     rPUx,
   @{bin}/tune2fs    rPx,
   @{bin}/xfs_io     rPUx,
 
   @{open_path}      rPx -> child-open,
 
+  /etc/fstab r,
+
         @{HOME}/.Xauthority r,
   owner @{HOME}/*.htm w,