feat(profiles): general update.

apparmor.d/groups/systemd/journalctl

@@ -8,7 +8,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}bin/journalctl
-profile journalctl @{exec_path} {
+profile journalctl @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
@@ -47,5 +47,7 @@ profile journalctl @{exec_path} {
 
   owner @{PROC}/@{pid}/cgroup r,
 
+  deny /apparmor/.null rw,
+
   include if exists <local/systemd-journalctl>
 }