refactor: move child-systemctl the children group.

apparmor.d/groups/systemd/child-systemctl

@@ -1,53 +0,0 @@
-# apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2019-2021 Mikhail Morfikov
-# SPDX-License-Identifier: GPL-2.0-only
-
-# Note: This profile does not specify an attachment path because it is
-# intended to be used only via "Px -> child-systemctl" exec transitions
-# from other profiles. We want to confine the systemctl(1) utility when
-# it is invoked from other confined applications, but not when it is
-# used in regular (unconfined) shell scripts or run directly by the user.
-
-abi <abi/3.0>,
-
-include <tunables/global>
-
-# Do not attach to /{usr/,}bin/systemctl by default
-profile child-systemctl flags=(attach_disconnected) {
-  include <abstractions/base>
-  include <abstractions/consoles>
-  include <abstractions/dbus-strict>
-  include <abstractions/wutmp>
-
-  capability net_admin,
-  capability sys_ptrace,
-
-  ptrace (read),
-
-  network inet stream,
-  network inet6 stream,
-
-  dbus send bus=system path=/org/freedesktop/systemd[0-9]/Unit
-       interface=org.freedesktop.systemd[0-9].Manager
-       member=GetUnitFileState,
-
-  /{usr/,}bin/systemctl mr,
-
-  /etc/systemd/user/{,**} rwl,
-
-  @{run}/systemd/private rw,
-
-  owner @{PROC}/@{pid}/stat r,
-        @{PROC}/sys/kernel/osrelease r,
-        @{PROC}/1/environ r,
-        @{PROC}/1/sched r,
-        @{PROC}/cmdline r,
-
-  @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
-
-  /dev/kmsg w,
-
-  deny /apparmor/.null rw,
-
-  include if exists <local/child-systemctl>
-}