feat(profiles): general update.

apparmor.d/groups/systemd/journalctl

@@ -8,7 +8,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}bin/journalctl
-profile journalctl @{exec_path} {
+profile journalctl @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
@@ -47,5 +47,7 @@ profile journalctl @{exec_path} {
 
   owner @{PROC}/@{pid}/cgroup r,
 
+  deny /apparmor/.null rw,
+
   include if exists <local/systemd-journalctl>
 }

apparmor.d/groups/systemd/systemd-machine-id-setup

@@ -17,5 +17,7 @@ profile systemd-machine-id-setup @{exec_path} {
 
   /etc/machine-id rw,
 
+  owner @{PROC}/@{pid}/stat r,
+
   include if exists <local/systemd-machine-id-setup>
 }

apparmor.d/groups/systemd/systemd-mount

@@ -21,5 +21,7 @@ profile systemd-mount @{exec_path} {
   @{sys}/bus/ r,
   @{sys}/class/ r,
 
+  owner @{PROC}/@{pid}/mountinfo r,
+
   include if exists <local/systemd-mount>
 }

apparmor.d/groups/systemd/userdbctl

@@ -16,7 +16,9 @@ profile userdbctl @{exec_path} {
 
   @{exec_path} mr,
   
-  /{usr/,}bin/less rPx -> child-pager,
+  /{usr/,}bin/less  rPx -> child-pager,
+  /{usr/,}bin/more  rPx -> child-pager,
+  /{usr/,}bin/pager rPx -> child-pager,
 
   /etc/shadow r,
   /etc/gshadow r,