feat(opensuse): final opensuse integration.

apparmor.d/profiles-g-l/htop

@@ -79,6 +79,7 @@ profile htop @{exec_path} {
   @{PROC}/@{pids}/task/@{tid}/status r,
   @{PROC}/@{pids}/task/@{tid}/wchan r,
 
+  @{sys}/bus/i2c/devices/ r,
   @{sys}/class/hwmon/ r,
   @{sys}/class/i2c-adapter/ r,
   @{sys}/class/power_supply/ r,

apparmor.d/profiles-g-l/irqbalance

@@ -10,6 +10,10 @@ include <tunables/global>
 profile irqbalance @{exec_path} {
   include <abstractions/base>
 
+  capability setpcap,
+
+  network netlink raw,
+
   @{exec_path} mr,
 
   @{run}/irqbalance/irqbalance[0-9]*.sock w,
@@ -25,6 +29,7 @@ profile irqbalance @{exec_path} {
   @{sys}/devices/system/node/ r,
   @{sys}/devices/system/node/node[0-9]*/ r,
   @{sys}/devices/system/node/node[0-9]*/{cpumap,meminfo} r,
+  @{sys}/devices/system/cpu/nohz_full r,
 
   @{PROC}/interrupts r,
   @{PROC}/irq/[0-9]*/node r,

apparmor.d/profiles-g-l/kmod

@@ -26,7 +26,7 @@ profile kmod @{exec_path} flags=(attach_disconnected) {
 
   /{usr/,}bin/{,ba,da}sh  rix,
   /{usr/,}bin/false       rix,
-  /{usr/,}bin/sysctl      rPx,
+  /{usr/,}{s,}bin/sysctl  rPx,
   /{usr/,}bin/true        rix,
 
   /{usr/,}lib/modprobe.d/{,*.conf} r,

apparmor.d/profiles-g-l/logrotate

@@ -29,21 +29,22 @@ profile logrotate @{exec_path} flags=(attach_disconnected) {
 
   /{usr/,}{s,}bin/ r,
 
+  /{usr/,}{s,}bin/invoke-rc.d        rix,
   /{usr/,}bin/{,ba,da}sh             rix,
   /{usr/,}bin/cat                    rix,
   /{usr/,}bin/grep                   rix,
-  /{usr/,}bin/shred                  rix,
+  /{usr/,}bin/gzip                   rix,
   /{usr/,}bin/kill                   rix,
   /{usr/,}bin/ls                     rix,
-  /{usr/,}bin/gzip                   rix,
+  /{usr/,}bin/shred                  rix,
+  /{usr/,}bin/xz                     rix,
   /{usr/,}bin/zstd                   rix,
-  /{usr/,}{s,}bin/invoke-rc.d        rix,
   /{usr/,}lib/rsyslog/rsyslog-rotate rix,
 
   /{usr/,}bin/fail2ban-client                   rPx,
-  /{usr/,}bin/systemd-tty-ask-password-agent    rPx,
   /{usr/,}bin/my_print_defaults                 rPUx,
   /{usr/,}bin/mysqladmin                        rPUx,
+  /{usr/,}bin/systemd-tty-ask-password-agent    rPx,
   /{usr/,}lib/php/php[7-8].[3-4]-fpm-reopenlogs rPUx,
 
   # no new privs
@@ -59,22 +60,20 @@ profile logrotate @{exec_path} flags=(attach_disconnected) {
         @{PROC}/cmdline r,
         @{PROC}/sys/kernel/osrelease r,
 
-  owner @{run}/systemd/private rw,
-
   /etc/ r,
   /etc/logrotate.conf rk,
   /etc/logrotate.d/ r,
   /etc/logrotate.d/* rk,
 
-  /var/lib/logrotate/status rwk,
-  /var/lib/logrotate/status.tmp rw,
-  /var/lib/logrotate.status rwk,
-  /var/lib/logrotate.status.tmp rw,
-
   / r,
   /var/log{,.hdd}/   r,
   /var/log{,.hdd}/** rw,
 
+  /var/lib/{,misc/}logrotate/status rwk,
+  /var/lib/{,misc/}logrotate/status.tmp rw,
+  /var/lib/{,misc/}logrotate.status rwk,
+  /var/lib/{,misc/}logrotate.status.tmp rw,
+
   @{run}/systemd/private rw,
 
   @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,