From f35b64bcaec3dd23c11ab55c1b0fd3f0a21d849b Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Mon, 11 Aug 2025 22:27:08 +0200
Subject: [PATCH] fix(profile): missing documented udev/data

---
 apparmor.d/abstractions/app/udevadm       | 3 ++-
 apparmor.d/groups/_full/sd                | 3 ++-
 apparmor.d/groups/systemd/systemd-analyze | 3 ++-
 apparmor.d/profiles-a-f/ddcutil           | 3 ++-
 4 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/apparmor.d/abstractions/app/udevadm b/apparmor.d/abstractions/app/udevadm
index e8414d026..d659143d6 100644
--- a/apparmor.d/abstractions/app/udevadm
+++ b/apparmor.d/abstractions/app/udevadm
@@ -11,7 +11,8 @@
 
   /etc/udev/udev.conf r,
 
-  @{run}/udev/data/* r,
+  @{run}/udev/data/+*:* r,                # Identifies all subsystems
+  @{run}/udev/data/c@{int}:@{int} r,      # Identifies all character devices
 
   @{sys}/** r,
 
diff --git a/apparmor.d/groups/_full/sd b/apparmor.d/groups/_full/sd
index da14cabf3..13864f2dd 100644
--- a/apparmor.d/groups/_full/sd
+++ b/apparmor.d/groups/_full/sd
@@ -187,7 +187,8 @@ profile sd flags=(attach_disconnected,mediate_deleted,complain) {
   owner @{run}/*/** rw,
 
   @{run}/udev/**/ r,
-  @{run}/udev/data/* r,
+  @{run}/udev/data/+*:* r,                # Identifies all subsystems
+  @{run}/udev/data/c@{int}:@{int} r,      # Identifies all character devices
 
   @{sys}/** r,
   @{sys}/fs/bpf/systemd/{,**} w,
diff --git a/apparmor.d/groups/systemd/systemd-analyze b/apparmor.d/groups/systemd/systemd-analyze
index 7310586e8..3ae0a7143 100644
--- a/apparmor.d/groups/systemd/systemd-analyze
+++ b/apparmor.d/groups/systemd/systemd-analyze
@@ -47,7 +47,8 @@ profile systemd-analyze @{exec_path} {
   @{run}/systemd/system/ r,
   @{run}/systemd/transient/ r,
   @{run}/systemd/userdb/io.systemd.DynamicUser w,
-  @{run}/udev/data/* r,
+  @{run}/udev/data/+*:* r,                # Identifies all subsystems
+  @{run}/udev/data/c@{int}:@{int} r,      # Identifies all character devices
   @{run}/udev/tags/systemd/ r,
 
   @{sys}/devices/**/uevent r,
diff --git a/apparmor.d/profiles-a-f/ddcutil b/apparmor.d/profiles-a-f/ddcutil
index 7c353bf65..d8cb23a5c 100644
--- a/apparmor.d/profiles-a-f/ddcutil
+++ b/apparmor.d/profiles-a-f/ddcutil
@@ -28,7 +28,8 @@ profile ddcutil @{exec_path} {
   owner @{user_cache_dirs}/ddcutil/ rw,
   owner @{user_cache_dirs}/ddcutil/** rwlk,
 
-  @{run}/udev/data/* r,
+  @{run}/udev/data/+*:* r,                # Identifies all subsystems
+  @{run}/udev/data/c@{int}:@{int} r,      # Identifies all character devices
 
   @{sys}/ r,
   @{sys}/bus/ r,