feat(profiles): general update.

apparmor.d/groups/network/mullvad-daemon

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = "/opt/Mullvad VPN/resources/mullvad-daemon"
-profile mullvad-daemon @{exec_path} {
+profile mullvad-daemon @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
 
@@ -29,6 +29,9 @@ profile mullvad-daemon @{exec_path} {
 
   @{exec_path} mr,
 
+  /{usr/,}bin/ip  rix,
+
+  "/opt/Mullvad VPN/resources/openvpn" rix,
   "/opt/Mullvad VPN/resources/*" r,
 
   /etc/mullvad-vpn/{,*} r,
@@ -47,8 +50,13 @@ profile mullvad-daemon @{exec_path} {
   @{sys}/fs/cgroup/net_cls/mullvad-exclusions/net_cls.classid rw,
   @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
 
+  owner /tmp/@{uuid} rw,
+  owner /tmp/talpid-openvpn-@{uuid} rw,
+
   owner @{PROC}/@{pid}/mounts r,
         @{PROC}/sys/net/ipv{4,6}/conf/all/src_valid_mark rw,
 
+  /dev/net/tun rw,
+
   include if exists <local/mullvad-daemon>
 }

apparmor.d/groups/network/tailscaled

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}{,s}bin/tailscaled
-profile tailscaled @{exec_path} {
+profile tailscaled @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
@@ -22,6 +22,8 @@ profile tailscaled @{exec_path} {
   network inet6 dgram,
   network inet stream,
   network inet6 stream,
+  network inet raw,
+  network inet6 raw,
   network netlink raw,
 
   ptrace (read),
@@ -39,8 +41,9 @@ profile tailscaled @{exec_path} {
   /etc/resolv.conf rw,
   /etc/resolv.conf.*.tmp rw,
 
-  owner /var/lib/tailscale/{,**} rw,
   owner @{run}/tailscale/{,**} rw,
+  owner /var/cache/{,**} rw,
+  owner /var/lib/tailscale/{,**} rw,
 
   @{sys}/devices/virtual/dmi/id/{bios_vendor,product_name} r,
   @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,