feat(profile): general update.

apparmor.d/groups/systemd/systemd-generator-ds-identify

@@ -25,6 +25,7 @@ profile systemd-generator-ds-identify @{exec_path} flags=(attach_disconnected) {
   /etc/cloud/{,**} r,
 
   @{run}/cloud-init/{,.}ds-identify.* rw,
+  @{run}/cloud-init/cloud.cfg rw,
 
   @{sys}/devices/virtual/dmi/id/chassis_asset_tag r,
   @{sys}/devices/virtual/dmi/id/product_name r,

apparmor.d/groups/systemd/systemd-id128

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/systemd-id128
 profile systemd-id128 @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
 
   @{exec_path} mr,
 

apparmor.d/groups/systemd/systemd-machined

@@ -24,6 +24,12 @@ profile systemd-machined @{exec_path} {
   capability sys_chroot,
   capability sys_ptrace,
 
+  network inet stream,
+  network inet6 stream,
+  network inet dgram,
+  network inet6 dgram,
+  network netlink raw,
+
   # dbus: own bus=system name=org.freedesktop.machine1
 
   # dbus: talk bus=system name=org.freedesktop.systemd1 label="@{systemd}"

apparmor.d/groups/systemd/systemd-oomd

@@ -15,13 +15,16 @@ profile systemd-oomd @{exec_path} flags=(attach_disconnected) {
   capability dac_override,
   capability kill,
 
+  unix (bind) type=stream addr=@@{hex}/bus/systemd-oomd/bus-api-oom,
+
   # dbus: own bus=system name=org.freedesktop.oom1
 
   @{exec_path} mr,
 
   /etc/systemd/oomd.conf r,
 
-        @{run}/systemd/io.system.ManagedOOM rw,
+          @{run}/systemd/io.system.ManagedOOM rw,
+          @{run}/systemd/io.systemd.ManagedOOM rw,
         @{run}/systemd/notify rw,
   owner @{run}/systemd/journal/socket w,
 

apparmor.d/groups/systemd/systemd-portabled

@@ -11,8 +11,26 @@ profile systemd-portabled @{exec_path} {
   include <abstractions/base>
   include <abstractions/systemd-common>
 
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability fsetid,
+  capability kill,
+  capability mknod,
+  capability setgid,
+  capability sys_admin,
+  capability sys_chroot,
   capability sys_ptrace,
 
+  network inet stream,
+  network inet6 stream,
+  network inet dgram,
+  network inet6 dgram,
+  network netlink raw,
+
+  # dbus: own bus=system name=org.freedesktop.portable1
+
   @{exec_path} mr,
 
   /var/lib/portables/{,**} rw,