Permissions for warning scripts

apparmor.d/profiles-s-z/smartd

@@ -11,6 +11,7 @@ include <tunables/global>
 profile smartd @{exec_path} {
   include <abstractions/base>
   include <abstractions/disks-read>
+  include <abstractions/nameservice-strict>
 
   # To remove the following errors:
   #  Device: /dev/disk/by-id/ata-*, IE (SMART) not enabled, skip device
@@ -24,6 +25,14 @@ profile smartd @{exec_path} {
   deny capability net_admin,
 
   @{exec_path} mr,
+  /{usr/,}bin/{,ba,da}sh rix,
+  /{usr/,}bin/cat        rix,
+  /{usr/,}bin/hostname   rix,
+  /{usr/,}bin/mail       rix,
+  /{usr/,}bin/mktemp     rix,
+  /{usr/,}bin/run-parts  rix,
+  /usr/share/smartmontools/{smartd-runner,smartd_warning.sh} rix,
+  /etc/smartmontools/run.d/* rix,
 
   /etc/smartd.conf r,
 
@@ -42,6 +51,7 @@ profile smartd @{exec_path} {
   @{PROC}/devices r,
 
   /run/systemd/notify rw,
+  /tmp/tmp.* rw,
 
   include if exists <local/smartd>
 }