From da9cb8c786f4ed52841df2a95ae9c3b432088d9d Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Sat, 12 Jul 2025 20:09:41 +0200
Subject: [PATCH] feat(profile): update pacman profiles.

---
 apparmor.d/groups/pacman/makepkg  | 5 +++--
 apparmor.d/groups/pacman/paccache | 1 +
 apparmor.d/groups/pacman/pacman   | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/apparmor.d/groups/pacman/makepkg b/apparmor.d/groups/pacman/makepkg
index 30650d80c..583d0b9c0 100644
--- a/apparmor.d/groups/pacman/makepkg
+++ b/apparmor.d/groups/pacman/makepkg
@@ -11,6 +11,7 @@ profile makepkg @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
+  include <abstractions/path>
   include <abstractions/perl>
   include <abstractions/python>
   include <abstractions/shells>
@@ -72,8 +73,8 @@ profile makepkg @{exec_path} {
     owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.scdaemon rw,
     owner @{run}/user/@{uid}/gnupg/S.scdaemon rw,
 
-    owner @{PROC}/@{pid}/fd/ r,
-    owner @{PROC}/@{pid}/task/@{tid}/comm rw,
+    @{PROC}/@{pid}/fd/ r,
+    @{PROC}/@{pid}/task/@{tid}/comm rw,
 
     include if exists <local/makepkg_gpg>
   }
diff --git a/apparmor.d/groups/pacman/paccache b/apparmor.d/groups/pacman/paccache
index f537afdb3..8bf1aed6a 100644
--- a/apparmor.d/groups/pacman/paccache
+++ b/apparmor.d/groups/pacman/paccache
@@ -36,6 +36,7 @@ profile paccache @{exec_path} flags=(attach_disconnected) {
 
   /etc/pacman.conf r,
   /etc/pacman.d/{,**} r,
+  /etc/pacman.d/gnupg/** rwlk -> /etc/pacman.d/gnupg/**,
 
   /var/cache/pacman/pkg/{,*} rw,
   /var/lib/pacman/{,**} r,
diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman
index ff43e2196..01543d63f 100644
--- a/apparmor.d/groups/pacman/pacman
+++ b/apparmor.d/groups/pacman/pacman
@@ -187,7 +187,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) {
     include if exists <local/pacman_gpg>
   }
 
-  profile systemctl {
+  profile systemctl flags=(attach_disconnected) {
     include <abstractions/base>
     include <abstractions/app/systemctl>