From c7b99bb84e9098e57a368c1a237838f11095116d Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Thu, 11 Sep 2025 23:26:31 +0200
Subject: [PATCH] feat(profile): update some core profiles.

---
 apparmor.d/profiles-g-l/kdump-config          |  2 +
 apparmor.d/profiles-g-l/kdump-tools-init      |  2 +
 apparmor.d/profiles-g-l/kdump_mem_estimator   |  2 +
 apparmor.d/profiles-g-l/kernel-postinst-kdump |  8 +++-
 apparmor.d/profiles-g-l/logrotate             |  2 +
 apparmor.d/profiles-m-r/initramfs-hooks       |  6 ++-
 apparmor.d/profiles-m-r/mdadm                 |  1 +
 apparmor.d/profiles-m-r/mkinitramfs           | 48 ++++++-------------
 apparmor.d/profiles-m-r/needrestart           |  2 +
 apparmor.d/profiles-m-r/rsyslogd              |  1 +
 10 files changed, 37 insertions(+), 37 deletions(-)

diff --git a/apparmor.d/profiles-g-l/kdump-config b/apparmor.d/profiles-g-l/kdump-config
index 2bd8ef6b9..75c536612 100644
--- a/apparmor.d/profiles-g-l/kdump-config
+++ b/apparmor.d/profiles-g-l/kdump-config
@@ -72,6 +72,8 @@ profile kdump-config @{exec_path} flags=(attach_disconnected) {
     capability net_admin,
     capability sys_ptrace,
 
+    ptrace read peer=@{p_systemd},
+
     include if exists <local/kdump-config_systemctl>
   }
 
diff --git a/apparmor.d/profiles-g-l/kdump-tools-init b/apparmor.d/profiles-g-l/kdump-tools-init
index b5af4dcc9..7767831a8 100644
--- a/apparmor.d/profiles-g-l/kdump-tools-init
+++ b/apparmor.d/profiles-g-l/kdump-tools-init
@@ -29,6 +29,8 @@ profile kdump-tools-init @{exec_path} flags=(attach_disconnected) {
 
     capability net_admin,
 
+    ptrace read peer=@{p_systemd},
+
     include if exists <local/kdump-tools-init_systemctl>
   }
 
diff --git a/apparmor.d/profiles-g-l/kdump_mem_estimator b/apparmor.d/profiles-g-l/kdump_mem_estimator
index b80a89343..5f85af3fe 100644
--- a/apparmor.d/profiles-g-l/kdump_mem_estimator
+++ b/apparmor.d/profiles-g-l/kdump_mem_estimator
@@ -27,6 +27,8 @@ profile kdump_mem_estimator @{exec_path} {
 
     capability net_admin,
 
+    ptrace read peer=@{p_systemd},
+
     include if exists <local/kdump_mem_estimator_systemctl>
   }
 
diff --git a/apparmor.d/profiles-g-l/kernel-postinst-kdump b/apparmor.d/profiles-g-l/kernel-postinst-kdump
index 50606695a..eb17c5355 100644
--- a/apparmor.d/profiles-g-l/kernel-postinst-kdump
+++ b/apparmor.d/profiles-g-l/kernel-postinst-kdump
@@ -31,8 +31,7 @@ profile kernel-postinst-kdump @{exec_path} {
 
   / r,
 
-  /etc/initramfs-tools/conf.d/{,**} r,
-  /etc/initramfs-tools/initramfs.conf r,
+  /etc/initramfs-tools/{,**} r,
 
   owner /var/lib/kdump/** rw,
 
@@ -49,6 +48,11 @@ profile kernel-postinst-kdump @{exec_path} {
     include <abstractions/base>
     include <abstractions/app/kmod>
 
+    @{sys}/module/*/ r,
+    @{sys}/module/*/coresize r,
+    @{sys}/module/*/holders/ r,
+    @{sys}/module/*/refcnt r,
+
     include if exists <local/kernel-postinst-kdump_kmod>
   }
 
diff --git a/apparmor.d/profiles-g-l/logrotate b/apparmor.d/profiles-g-l/logrotate
index 0dee9ed6a..781a01a27 100644
--- a/apparmor.d/profiles-g-l/logrotate
+++ b/apparmor.d/profiles-g-l/logrotate
@@ -80,6 +80,8 @@ profile logrotate @{exec_path} flags=(attach_disconnected) {
     capability net_admin,
     capability sys_ptrace,
 
+    ptrace read peer=@{p_systemd},
+
     dbus send bus=system path=/org/freedesktop/systemd1
          interface=org.freedesktop.systemd1.Manager
          member=KillUnit
diff --git a/apparmor.d/profiles-m-r/initramfs-hooks b/apparmor.d/profiles-m-r/initramfs-hooks
index 136536764..89a57310f 100644
--- a/apparmor.d/profiles-m-r/initramfs-hooks
+++ b/apparmor.d/profiles-m-r/initramfs-hooks
@@ -10,6 +10,7 @@ include <tunables/global>
 profile initramfs-hooks @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
+  include <abstractions/fonts>
   include <abstractions/nameservice-strict>
 
   @{exec_path} mr,
@@ -37,9 +38,9 @@ profile initramfs-hooks @{exec_path} {
   @{lib}/ r,
   @{lib}/** mr,
 
+  /usr/share/*/initramfs/{,**} r,
   /usr/share/initramfs-tools/{,**} r,
   /usr/share/plymouth/{,**} r,
-  /usr/share/cryptsetup/initramfs/{,**} r,
 
   /etc/console-setup/{,**} r,
   /etc/cryptsetup-initramfs/{,**} r,
@@ -81,8 +82,9 @@ profile initramfs-hooks @{exec_path} {
     include <abstractions/consoles>
     include <abstractions/nameservice-strict>
 
-    @{bin}/ldd mr,
     @{bin}/* mr,
+    @{sbin}/* mr,
+
     @{lib}/@{multiarch}/ld-linux-*so* mrix,
     @{lib}/ld-linux.so* mr,
 
diff --git a/apparmor.d/profiles-m-r/mdadm b/apparmor.d/profiles-m-r/mdadm
index 4cc5fc9fb..e40f6b1e3 100644
--- a/apparmor.d/profiles-m-r/mdadm
+++ b/apparmor.d/profiles-m-r/mdadm
@@ -12,6 +12,7 @@ profile mdadm @{exec_path} flags=(attach_disconnected) {
   include <abstractions/consoles>
   include <abstractions/disks-write>
 
+  capability dac_read_search,
   capability sys_admin,
 
   mqueue (read getattr) type=posix /,
diff --git a/apparmor.d/profiles-m-r/mkinitramfs b/apparmor.d/profiles-m-r/mkinitramfs
index c6caf364f..d94e5aa44 100644
--- a/apparmor.d/profiles-m-r/mkinitramfs
+++ b/apparmor.d/profiles-m-r/mkinitramfs
@@ -33,6 +33,7 @@ profile mkinitramfs @{exec_path} {
   @{bin}/cpio       rix,
   @{bin}/dirname    rix,
   @{bin}/env        rix,
+  @{bin}/find       rix,
   @{bin}/getopt     rix,
   @{bin}/gzip       rix,
   @{bin}/id         rix,
@@ -56,10 +57,9 @@ profile mkinitramfs @{exec_path} {
   @{bin}/xargs      rix,
   @{bin}/xz         rix,
   @{bin}/zstd       rix,
-  @{sbin}/blkid     rPx,
   @{lib}/dracut/dracut-install rix,
+  @{sbin}/blkid     rPx,
 
-  @{bin}/find                 rCx -> find,
   @{bin}/kmod                 rCx -> kmod,
   @{sbin}/ldconfig            rCx -> ldconfig,
   @{bin}/ldd                  rCx -> ldd,
@@ -113,11 +113,16 @@ profile mkinitramfs @{exec_path} {
 
   @{sys}/bus/ r,
   @{sys}/bus/*/drivers/ r,
-  @{sys}/devices/platform/ r,
-  @{sys}/devices/platform/**/ r,
-  @{sys}/devices/platform/**/modalias r,
+  @{sys}/devices/ r,
+  @{sys}/devices/**/ r,
+  @{sys}/devices/**/modalias r,
+  @{sys}/devices/**/uevent r,
   @{sys}/module/compression r,
   @{sys}/module/firmware_class/parameters/path r,
+  @{sys}/class/ r,
+  @{sys}/class/*/ r,
+
+  @{sys}/bus/platform/drivers/simple-framebuffer/ r,
 
         @{PROC}/@{pid}/mounts r,
         @{PROC}/cmdline r,
@@ -129,17 +134,14 @@ profile mkinitramfs @{exec_path} {
     include <abstractions/consoles>
     include <abstractions/nameservice-strict>
 
-    @{bin}/ldd mr,
-    @{lib}/@{multiarch}/ld-linux-*so* mr,
-    @{lib}/ld-linux.so* mr,
-
-    @{sh_path}        rix,
-    @{bin}/kmod mr,
-    @{lib}/initramfs-tools/bin/* mr,
-
+    @{sh_path}                    rix,
     @{lib}/@{multiarch}/ld-*.so*  rix,
     @{lib}/ld-*.so{,.2}           rix,
 
+    @{bin}/* mr,
+    @{sbin}/* mr,
+    @{lib}/** mr,
+
     include if exists <local/mkinitramfs_ldd>
   }
 
@@ -160,26 +162,6 @@ profile mkinitramfs @{exec_path} {
     include if exists <local/mkinitramfs_ldconfig>
   }
 
-  profile find {
-    include <abstractions/base>
-    include <abstractions/consoles>
-
-    @{bin}/find mr,
-
-    # pwd dir
-    / r,
-    /etc/ r,
-    /root/ r,
-
-    /usr/share/initramfs-tools/scripts/{,**/} r,
-    /etc/initramfs-tools/scripts/{,**/} r,
-
-    owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/{,**/} r,
-    owner /var/tmp/mkinitramfs_@{rand6}/{,**/} r,
-
-    include if exists <local/mkinitramfs_find>
-  }
-
   profile kmod {
     include <abstractions/base>
     include <abstractions/app/kmod>
diff --git a/apparmor.d/profiles-m-r/needrestart b/apparmor.d/profiles-m-r/needrestart
index 8c908ddb4..c55393753 100644
--- a/apparmor.d/profiles-m-r/needrestart
+++ b/apparmor.d/profiles-m-r/needrestart
@@ -59,7 +59,9 @@ profile needrestart @{exec_path} flags=(attach_disconnected) {
         @{PROC}/@{pid}/cgroup r,
         @{PROC}/@{pid}/cmdline r,
         @{PROC}/@{pid}/environ r,
+        @{PROC}/@{pid}/maps r,
         @{PROC}/@{pid}/stat r,
+        @{PROC}/@{pid}/status r,
   owner @{PROC}/@{pid}/fd/ r,
 
   /dev/ r,
diff --git a/apparmor.d/profiles-m-r/rsyslogd b/apparmor.d/profiles-m-r/rsyslogd
index ede981f58..c5e5ac051 100644
--- a/apparmor.d/profiles-m-r/rsyslogd
+++ b/apparmor.d/profiles-m-r/rsyslogd
@@ -45,6 +45,7 @@ profile rsyslogd @{exec_path} {
   @{PROC}/cmdline r,
   @{PROC}/kmsg r,
   @{PROC}/sys/kernel/osrelease r,
+  @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
 
   include if exists <local/rsyslogd>
 }