feat(profile): general update.

apparmor.d/profiles-m-r/needrestart-apt-pinvoke

@@ -7,7 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{exec_path} = @{lib}/needrestart/apt-pinvoke
-profile needrestart-apt-pinvoke @{exec_path} {
+profile needrestart-apt-pinvoke @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus-system>
   include <abstractions/bus/org.freedesktop.login1>
@@ -24,6 +24,8 @@ profile needrestart-apt-pinvoke @{exec_path} {
 
   @{run}/needrestart/{,**} rw,
 
+  /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
+
   include if exists <local/needrestart-apt-pinvoke>
 }
 

apparmor.d/profiles-m-r/os-prober

@@ -15,8 +15,13 @@ profile os-prober @{exec_path} flags=(attach_disconnected) {
   capability dac_read_search,
   capability sys_admin,
 
+  mount options=(rprivate, rw)      -> /,
+  mount options=(rw, nosuid, nodev) -> /var/lib/os-prober/mount/,
+
   umount /var/lib/os-prober/mount/,
 
+  mqueue (read getattr) type=posix /,
+
   @{exec_path} mrix,
 
   @{sh_path}               rix,

apparmor.d/profiles-m-r/packagekitd

@@ -69,6 +69,7 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
   @{bin}/fc-cache                    rPx,
   @{bin}/glib-compile-schemas        rPx,
   @{bin}/install-info                rPx,
+  @{bin}/rpm                        rPUx, #aa:only opensuse
   @{bin}/rpmdb2solv                 rPUx, #aa:only opensuse
   @{bin}/systemd-inhibit             rPx,
   @{bin}/update-desktop-database     rPx,

apparmor.d/profiles-m-r/remmina

@@ -25,6 +25,7 @@ profile remmina @{exec_path} {
   include <abstractions/ibus>
   include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
+  include <abstractions/thumbnails-cache-read>
   include <abstractions/user-download-strict>
 
   network inet stream,
@@ -35,16 +36,20 @@ profile remmina @{exec_path} {
   #aa:dbus talk bus=session name=org.ayatana.NotificationItem label=gnome-shell
   #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}"
 
-  @{exec_path} r,
+  @{exec_path} rm,
+
+  @{open_path} rPx -> child-open-browsers,
 
   /usr/share/remmina/{,**} r,
   /usr/share/themes/{,**} r,
 
-  /etc/timezone r,
+  /etc/fstab r,
   /etc/ssh/ssh_config r,
   /etc/ssh/ssh_config.d/{,*} r,
+  /etc/timezone r,
 
-  owner @{HOME}/@{XDG_SSH_DIR}/{,*} r,
+  owner @{HOME}/@{XDG_SSH_DIR}/config r,
+  owner @{HOME}/@{XDG_SSH_DIR}/known_hosts r,
 
   owner @{user_cache_dirs}/org.remmina.Remmina/{,**} rw,
   owner @{user_cache_dirs}/remmina/{,**} rw,