Profiles update.

apparmor.d/profiles-m-r/pass

@@ -41,7 +41,7 @@ profile pass @{exec_path} {
   /{usr/,}bin/tty       rix,
   /{usr/,}bin/which     rix,
 
-  /{usr/,}bin/git             rPx,
+  /{usr/,}bin/git             rCx -> git,
   /{usr/,}bin/gpg{2,}         rUx,
   /{usr/,}bin/vim             rCx -> editor,
   /{usr/,}bin/wl-{copy,paste} rPx,
@@ -89,6 +89,37 @@ profile pass @{exec_path} {
     deny owner @{HOME}/ r,
   }
 
+  profile git {
+    include <abstractions/base>
+    include <abstractions/nameservice-strict>
+    include <abstractions/openssl>
+    include <abstractions/ssl_certs>
+
+    network inet dgram,
+    network inet6 dgram,
+    network inet stream,
+    network inet6 stream,
+    network netlink raw,
+
+    /{usr/,}bin/git*                  mrix,
+    /{usr/,}@{libexec}/git-core/git*  mrix,
+
+    /{usr/,}bin/gpg{2,}  rUx,
+
+    /usr/share/git-core/{,**} r,
+
+    owner @{HOME}/.gitconfig r,
+    owner @{user_config_dirs}/git/{,*} r,
+
+    owner @{HOME}/.password-store/   rw,
+    owner @{HOME}/.password-store/** rwkl -> @{HOME}/.password-store/**,
+    owner @{HOME}/@{XDG_PROJECTS_DIR}/**/*-store/   rw,
+    owner @{HOME}/@{XDG_PROJECTS_DIR}/**/*-store/** rwkl -> @{HOME}/@{XDG_PROJECTS_DIR}/**/*-store/**,
+    owner @{user_config_dirs}/password-store/   rw,
+    owner @{user_config_dirs}/password-store/** rwkl -> @{user_config_dirs}/password-store/**,
+
+  }
+
   include if exists <usr/pass.d>
   include if exists <local/pass>
 }

apparmor.d/profiles-m-r/resolvconf

@@ -18,14 +18,16 @@ profile resolvconf @{exec_path} {
   /{usr/,}bin/flock       rix,
   /{usr/,}bin/mkdir       rix,
   /{usr/,}bin/mv          rix,
+  /{usr/,}bin/readlink    rix,
   /{usr/,}bin/rm          rix,
   /{usr/,}bin/run-parts   rix,
   /{usr/,}bin/sed         rix,
+  /{usr/,}lib/resolvconf/list-records rix,
 
   /usr/lib/resolvconf/{,**} r,
 
   /etc/resolv.conf rw,
-  /etc/resolvconf/update.d/libc mr,
+  /etc/resolvconf/update.d/libc rix,
 
   owner @{run}/resolvconf/{,**} rw,
   owner @{run}/resolvconf/run-lock wk,