feat(profiles): general update.

apparmor.d/groups/systemd/bootctl

@@ -39,15 +39,20 @@ profile bootctl @{exec_path} {
 
   @{run}/host/container-manager r,
 
+  @{sys}//class/tpmrm/ r,
+
   @{sys}/devices/virtual/dmi/id/{board_vendor,bios_vendor} r,
   @{sys}/devices/virtual/dmi/id/{sys_vendor,product_version,product_name} r,
 
   @{sys}/firmware/dmi/entries/*/raw r,
   @{sys}/firmware/efi/efivars/ r,
+  @{sys}/firmware/efi/efivars/AuditMode-@{uuid} r,
   @{sys}/firmware/efi/efivars/Boot[0-9A-F]*-@{uuid} r,
   @{sys}/firmware/efi/efivars/BootOrder-@{uuid} r,
+  @{sys}/firmware/efi/efivars/DeployedMode-@{uuid} r,
   @{sys}/firmware/efi/efivars/LoaderDevicePartUUID-@{uuid} r,
   @{sys}/firmware/efi/efivars/LoaderEntries-@{uuid} r,
+  @{sys}/firmware/efi/efivars/LoaderEntrySelected-@{uuid} r,
   @{sys}/firmware/efi/efivars/LoaderFeatures-@{uuid} r,
   @{sys}/firmware/efi/efivars/LoaderFirmwareInfo-@{uuid} r,
   @{sys}/firmware/efi/efivars/LoaderFirmwareType-@{uuid} r,

apparmor.d/groups/systemd/systemd-machine-id-setup

@@ -10,6 +10,8 @@ include <tunables/global>
 profile systemd-machine-id-setup @{exec_path} {
   include <abstractions/base>
 
+  capability dac_override,
+
   @{exec_path} mr,
 
   /etc/machine-id rw,

apparmor.d/groups/systemd/systemd-resolved

@@ -11,6 +11,7 @@ profile systemd-resolved @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/dbus-strict>
   include <abstractions/nameservice-strict>
+  include <abstractions/openssl>
   include <abstractions/p11-kit>
   include <abstractions/ssl_certs>
   include <abstractions/systemd-common>

apparmor.d/groups/systemd/systemd-udevd

@@ -49,8 +49,8 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
 
   /{usr/,}{s,}bin/*             rPUx,
 
-  /{usr,/}lib/pm-utils/power.d/*          rPUx,
-  /{usr,/}lib/snapd/snap-device-helper     rPx,
+  /{usr/,}lib/pm-utils/power.d/*          rPUx,
+  /{usr/,}lib/snapd/snap-device-helper     rPx,
   /{usr/,}lib/crda/*                      rPUx,
   /{usr/,}lib/gdm-runtime-config           rPx,
   /{usr/,}lib/systemd/systemd-*            rPx,