Update profiles.

apparmor.d/profiles-g-l/git

@@ -1,6 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2020-2021 Mikhail Morfikov
-#               2021 Alexandre Pujol <alexandre@pujol.io>
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -77,7 +77,11 @@ profile git @{exec_path} {
   /{usr/,}bin/vim             rCx -> editor,
   /{usr/,}bin/vim.*           rCx -> editor,
 
+  /{usr/,}lib/code/extensions/git/dist/askpass.sh rPx,
+  /usr/share/aurpublish/*.hook rPx,
+
   owner @{HOME}/.gitconfig r,
+  owner @{HOME}/.netrc r,
   owner @{user_config_dirs}/git/{,*} rw,
 
   /usr/share/git-core/{,**} r,
@@ -106,7 +110,6 @@ profile git @{exec_path} {
 
   /etc/mailname r,
 
-
   profile gpg {
     include <abstractions/base>
     include <abstractions/consoles>

apparmor.d/profiles-g-l/hugo

@@ -1,13 +1,12 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2020-2021 Mikhail Morfikov
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
 
 include <tunables/global>
 
-@{HUGO_DIR} = @{MOUNTS}/debuilder/hugo
-
 @{exec_path} = /{usr/,}bin/hugo
 profile hugo @{exec_path} {
   include <abstractions/base>
@@ -17,15 +16,12 @@ profile hugo @{exec_path} {
 
   @{exec_path} mr,
 
-  # Hugo dirs
-  owner @{HOME}/hugo/ r,
-  owner @{HOME}/hugo/** r,
-  owner @{HOME}/hugo/**/public/ rw,
-  owner @{HOME}/hugo/**/public/** rw,
-  owner @{HUGO_DIR}/ r,
-  owner @{HUGO_DIR}/** r,
-  owner @{HUGO_DIR}/**/public/ rw,
-  owner @{HUGO_DIR}/**/public/** rw,
+  /usr/share/mime/{,**} r,
+
+  /etc/mime.types r,
+
+  owner @{HOME}/@{XDG_PROJECTS_DIR}/{,**} rw,
+  owner @{HOME}/@{XDG_PROJECTS_DIR}/**/.hugo_build.lock rwk,
 
   owner /tmp/hugo_cache/ rw,
   owner /tmp/hugo_cache/**/ rw,
@@ -34,7 +30,5 @@ profile hugo @{exec_path} {
 
   @{PROC}/sys/net/core/somaxconn r,
 
-  /etc/mime.types r,
-
   include if exists <local/hugo>
-}
+}

apparmor.d/profiles-g-l/logrotate

@@ -12,15 +12,13 @@ profile logrotate @{exec_path} flags=(attach_disconnected, complain) {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
 
-  # Needed for logfiles owned by other users than root, for instance exim.
-  capability dac_read_search,
-  capability dac_override,
-
   capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability fsetid,
   capability setgid,
   capability setuid,
-  capability fsetid,
-  capability fowner,
 
   # Needed?
   audit deny capability net_admin,
@@ -67,7 +65,6 @@ profile logrotate @{exec_path} flags=(attach_disconnected, complain) {
 
   @{sys}/firmware/efi/efivars/SecureBoot-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r,
 
-
   profile systemctl flags=(attach_disconnected, complain) {
     include <abstractions/base>
     include <abstractions/wutmp>