feat(profiles): reorganise a few profiles.

apparmor.d/profiles-m-r/netstat

@@ -1,12 +1,10 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2002-2005 Novell/SUSE
-#               2017 Christian Boltz
-#               2018-2021 Mikhail Morfikov
+# Copyright (C) 2017 Christian Boltz
+# Copyright (C) 2018-2022 Mikhail Morfikov
+# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
-# Evolution, amongst other things, calls this program. I didn't want to
-# give evolution access to significant chunks of /proc
-
 abi <abi/3.0>,
 
 include <tunables/global>
@@ -18,32 +16,34 @@ profile netstat @{exec_path} {
   include <abstractions/nameservice>
 
   capability dac_read_search,
-  capability syslog,
   capability sys_ptrace,
+  capability syslog,
 
   ptrace (trace,read),
 
   @{exec_path} rmix,
 
   /etc/networks r,
-  @{PROC} r,
-  @{PROC}/@{pids}/cmdline r,
-  @{PROC}/net r,
-  @{PROC}/net/* r,
-  @{PROC}/@{pids}/fd/ r,
-  @{PROC}/@{pid}/attr/current r,
-  @{PROC}/@{pid}/net/netstat r,
-  @{PROC}/@{pid}/net/raw r,
-  @{PROC}/@{pid}/net/snmp r,
-  @{PROC}/@{pid}/net/raw6 r,
-  @{PROC}/@{pid}/net/tcp r,
-  @{PROC}/@{pid}/net/tcp6 r,
-  @{PROC}/@{pid}/net/udp r,
-  @{PROC}/@{pid}/net/udp6 r,
-  @{PROC}/@{pid}/net/udplite r,
-  @{PROC}/@{pid}/net/udplite6 r,
-  @{PROC}/@{pid}/net/unix r,
-  # For  "netstat -i"
-  @{PROC}/@{pid}/net/dev r,
 
+        @{PROC} r,
+        @{PROC}/@{pids}/cmdline r,
+        @{PROC}/@{pids}/fd/ r,
+        @{PROC}/@{pids}/net/dev r,
+        @{PROC}/@{pids}/net/netstat r,
+        @{PROC}/@{pids}/net/raw r,
+        @{PROC}/@{pids}/net/raw6 r,
+        @{PROC}/@{pids}/net/snmp r,
+        @{PROC}/@{pids}/net/tcp r,
+        @{PROC}/@{pids}/net/tcp6 r,
+        @{PROC}/@{pids}/net/udp r,
+        @{PROC}/@{pids}/net/udp6 r,
+        @{PROC}/@{pids}/net/udplite r,
+        @{PROC}/@{pids}/net/udplite6 r,
+        @{PROC}/@{pids}/net/unix r,
+        @{PROC}/net r,
+        @{PROC}/net/* r,
+        @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
+  owner @{PROC}/@{pid}/attr/current r,
+
+  include if exists <local/netstat>
 }