feat(profiles): improve support for debian over gnome.

apparmor.d/profiles-a-f/exim4

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2018-2021 Mikhail Morfikov
+# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -10,9 +11,19 @@ include <tunables/global>
 profile exim4 @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
+  include <abstractions/dbus-strict>
   include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
 
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability net_admin,
+  capability net_bind_service,
+  capability setgid,
+  capability setuid,
+
   network inet dgram,
   network inet6 dgram,
   network inet stream,
@@ -21,59 +32,26 @@ profile exim4 @{exec_path} {
 
   @{exec_path} mrix,
 
-  # To bind to port 25/tcp
-  capability net_bind_service,
-
-  # To remove the following error:
-  #  exim4[]: exim: setgroups() failed: Operation not permitted
-  capability setgid,
-
-  # To remove the following error:
-  #  exim4[]: unable to set gid=110 or uid=105 (euid=0): calling tls_validate_require_cipher
-  capability setuid,
-
-  # To remove the following error:
-  # exim4[]: Cannot open main log file "/var/log/exim4/mainlog": Permission denied: euid=0 egid=110
-  capability dac_read_search,
-  capability dac_override,
-
-  # To remove the following error:
-  #  exim.c:774: chown(/var/spool/exim4//msglog//1kqH5Z-000RUf-UR, 105:110) failed (Operation not
-  #  permitted). Please contact the authors and refer to https://bugs.exim.org/show_bug.cgi?id=2391
-  capability chown,
-
-  # To remove the following error:
-  #  Couldn't chmod message log /var/spool/exim4//msglog//1kqH6c-000S7r-Ni: Operation not permitted
-  capability fowner,
-
-  # Needed?
-  audit deny capability net_admin,
-
-  /var/lib/exim4/config.autogenerated{,.tmp} r,
-
   /etc/email-addresses r,
   /etc/aliases r,
 
+  /var/lib/exim4/config.autogenerated{,.tmp} r,
+
+  /var/lib/dpkg/status r,
+  /var/log/cron-apt/lastfullmessage r,
   /var/log/exim4/ w,
   /var/log/exim4/mainlog w,
   /var/log/exim4/paniclog w,
   /var/log/exim4/rejectlog w,
-
   /var/spool/exim4/ r,
   /var/spool/exim4/** rwk,
 
   owner /var/mail/* rwkl -> /var/mail/*,
 
+  /tmp/#@{int} rw,
+
         @{run}/exim4/ r,
   owner @{run}/exim4/exim.pid rw,
 
-        @{run}/resolvconf/resolv.conf r,
-  owner @{run}/dbus/system_bus_socket rw,
-
-  # file_inherit
-  /tmp/#@{int} rw,
-  /var/lib/dpkg/status r,
-  /var/log/cron-apt/lastfullmessage r,
-
   include if exists <local/exim4>
 }