feat(profile): general update.

apparmor.d/groups/systemd/busctl

@@ -22,6 +22,8 @@ profile busctl @{exec_path} {
 
   unix (bind) type=stream addr=@@{hex}/bus/busctl/busctl,
 
+  signal (send) set=(cont) peer=child-pager,
+
   dbus eavesdrop bus=session,
   dbus eavesdrop bus=system,
 
@@ -36,12 +38,12 @@ profile busctl @{exec_path} {
   @{bin}/more  rPx -> child-pager,
   @{bin}/pager rPx -> child-pager,
 
-  owner @{PROC}/@{pid}/cgroup r,
+        @{PROC}/@{pid}/cgroup r,
+        @{PROC}/@{pid}/comm r,
+        @{PROC}/@{pid}/stat r,
   owner @{PROC}/@{pid}/cmdline r,
-  owner @{PROC}/@{pid}/comm r,
   owner @{PROC}/@{pid}/loginuid r,
   owner @{PROC}/@{pid}/sessionid r,
-  owner @{PROC}/@{pid}/stat r,
 
   include if exists <local/busctl>
 }

apparmor.d/groups/systemd/systemd-generator-ds-identify

@@ -22,10 +22,19 @@ profile systemd-generator-ds-identify @{exec_path} flags=(attach_disconnected) {
   @{bin}/tr                      rix,
   @{bin}/uname                   rix,
 
+  /etc/cloud/{,**} r,
+
   @{run}/cloud-init/{,.}ds-identify.* rw,
 
+  @{sys}/devices/virtual/dmi/id/chassis_asset_tag r,
+  @{sys}/devices/virtual/dmi/id/product_name r,
+  @{sys}/devices/virtual/dmi/id/product_serial r,
+  @{sys}/devices/virtual/dmi/id/product_uuid r,
+  @{sys}/devices/virtual/dmi/id/sys_vendor r,
+
   @{PROC}/cmdline r,
   @{PROC}/uptime r,
+  @{PROC}/@{pid}/environ r,
 
   include if exists <local/systemd-generator-ds-identify>
 }

apparmor.d/groups/systemd/systemd-hwdb

@@ -16,7 +16,7 @@ profile systemd-hwdb @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   @{exec_path} mr,
 
   @{lib}/udev/#@{int} rwl,
-  @{lib}/udev/.#hwdb.bin[0-9a-zA-Z]* wl -> @{lib}/udev/#@{int},
+  @{lib}/udev/.#hwdb.bin@{hex} wl -> @{lib}/udev/#@{int},
   @{lib}/udev/hwdb.bin w,
 
   /etc/udev/.#hwdb.bind* rw,

apparmor.d/groups/systemd/systemd-machined

@@ -37,5 +37,10 @@ profile systemd-machined @{exec_path} {
   @{run}/systemd/userdb/io.systemd.Machine rw,
   @{run}/systemd/notify w,
 
+  @{PROC}/@{pid}/cgroup r,
+  @{PROC}/pressure/cpu r,
+  @{PROC}/pressure/io r,
+  @{PROC}/pressure/memory r,
+
   include if exists <local/systemd-machined>
 }

apparmor.d/groups/systemd/systemd-sysusers

@@ -33,17 +33,16 @@ profile systemd-sysusers @{exec_path} flags=(attach_disconnected) {
   /etc/{passwd,shadow} rw,
   /etc/{passwd,shadow}- rw,
   /etc/{passwd,shadow}+ rw,
-  /etc/.#{passwd,shadow}[0-9a-zA-Z]* rw,
+  /etc/.#{passwd,shadow}@{hex} rw,
   /etc/{group,gshadow} rw,
   /etc/{group,gshadow}- rw,
   /etc/{group,gshadow}+ rw,
-  /etc/.#{group,gshadow}[0-9a-zA-Z]* rw,
+  /etc/.#{group,gshadow}@{hex} rw,
   /etc/.pwd.lock rwk,
 
         /dev/tty@{int} rw,
   owner /dev/pts/@{int} rw,
 
-
   # Inherit Silencer
   deny network inet6 stream,
   deny network inet stream,

apparmor.d/groups/systemd/systemd-update-done

@@ -16,9 +16,9 @@ profile systemd-update-done @{exec_path} {
 
   @{exec_path} mr,
 
-  /etc/.#.updated[0-9a-zA-Z]* rw,
+  /etc/.#.updated@{hex} rw,
   /etc/.updated w,
-  /var/.#.updated[0-9a-zA-Z]* rw,
+  /var/.#.updated@{hex} rw,
   /var/.updated w,
 
   @{run}/host/container-manager r,

apparmor.d/groups/systemd/zram-generator

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = @{lib}/systemd/system-generators/zram-generator
-profile zram-generator @{exec_path} {
+profile zram-generator @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/systemd-common>