feat(profiles): minor improvments.

apparmor.d/groups/cron/cron

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-@{exec_path} = /{usr/,}sbin/cron
+@{exec_path} = /{usr/,}{s,}bin/cron
 profile cron @{exec_path} {
   include <abstractions/base>
   include <abstractions/nameservice-strict>

apparmor.d/groups/freedesktop/colord-sane

@@ -14,6 +14,8 @@ profile colord-sane @{exec_path} flags=(attach_disconnected,complain) {
   include <abstractions/dbus-strict>
   include <abstractions/devices-usb>
 
+  network inet dgram,
+  network inet6 dgram,
   network netlink raw,
 
   dbus (send,receive) bus=system path=/org/freedesktop/ColorManager

apparmor.d/groups/freedesktop/update-desktop-database

@@ -24,12 +24,15 @@ profile update-desktop-database @{exec_path} flags=(attach_disconnected) {
 
   /usr/share/*/*.desktop r,
 
-  /var/lib/flatpak/exports/share/applications/{,**/} r,
-  /var/lib/flatpak/exports/share/applications/**.desktop r,
-  /var/lib/flatpak/exports/share/applications/.mimeinfo.cache.* rw,
-  /var/lib/flatpak/exports/share/applications/mimeinfo.cache w,
+  /var/lib/flatpak/{app/**,}exports/share/applications/{,**/} r,
+  /var/lib/flatpak/{app/**,}exports/share/applications/**.desktop r,
+  /var/lib/flatpak/{app/**,}exports/share/applications/.mimeinfo.cache.* rw,
+  /var/lib/flatpak/{app/**,}exports/share/applications/mimeinfo.cache w,
 
-  /var/lib/flatpak/app/**/export/share/applications/**.desktop r,
+  /var/lib/snapd/desktop/applications/{,**/} r,
+  /var/lib/snapd/desktop/applications/**.desktop r,
+  /var/lib/snapd/desktop/applications/.mimeinfo.cache.* rw,
+  /var/lib/snapd/desktop/applications/mimeinfo.cache w,
 
   # Inherit silencer
   deny network inet6 stream,

apparmor.d/groups/network/nm-dispatcher

@@ -7,14 +7,28 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}lib/nm-dispatcher
+@{exec_path} += /{usr/,}lib/NetworkManager/nm-dispatcher
 profile nm-dispatcher @{exec_path} {
   include <abstractions/base>
+  include <abstractions/dbus-strict>
 
   capability sys_nice,
 
+  dbus receive bus=system path=/org/freedesktop/nm_dispatcher
+       interface=org.freedesktop.nm_dispatcher,
+
+  dbus bind bus=system
+       name=org.freedesktop.nm_dispatcher,
+
   @{exec_path} mr,
 
-  /etc/NetworkManager/dispatcher.d/{,**} r,
+  /{usr/,}bin/{,ba,da}sh  rix,
+  /{usr/,}bin/run-parts   rPx,
+
+  /etc/NetworkManager/dispatcher.d/ r,
+  /etc/NetworkManager/dispatcher.d/** rix,
+
+  @{run}/systemd/notify rw,
 
   include if exists <local/nm-dispatcher>
 }

apparmor.d/groups/pacman/mkinitcpio

@@ -70,6 +70,7 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) {
   /etc/vconsole.conf r,
 
   /usr/share/kbd/keymaps/{,**} r,
+  /usr/share/plymouth/*.png r,
   /usr/share/plymouth/plymouthd.defaults r,
   /usr/share/plymouth/themes/{,**} r,
   /usr/share/terminfo/x/xterm-256color r,

apparmor.d/groups/systemd/systemd-analyze

@@ -28,38 +28,35 @@ profile systemd-analyze @{exec_path} {
   /{usr/,}bin/more      rPx -> child-pager,
   /{usr/,}bin/man       rPx,
 
+  /usr/ r,
+  /{usr/,}lib/systemd/** r,
+
+  /etc/default/locale r,
+  /etc/locale.conf r,
+  /etc/systemd/** r,
+
+  owner /tmp/systemd-temporary-*/ rw,
+
+  @{run}/systemd/system/ r,
+  @{run}/systemd/userdb/io.systemd.DynamicUser w,
+  @{run}/udev/data/* r,
+  @{run}/udev/tags/systemd/ r,
+
+  @{sys}/devices/**/uevent r,
+  @{sys}/firmware/acpi/tables/FPDT r,
+  @{sys}/fs/cgroup/{,**} r,
+  @{sys}/fs/cgroup/{systemd,unified}/**/cgroup.procs rw,
+  @{sys}/fs/cgroup/unified/**/init.scope/ rw,
+  @{sys}/module/**/uevent r,
+
+  @{sys}/firmware/efi/efivars/LoaderTimeInitUSec-@{uuid} r,
+  @{sys}/firmware/efi/efivars/LoaderTimeExecUSec-@{uuid} r,
+
   owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/mountinfo r,
   owner @{PROC}/@{pid}/comm r,
         @{PROC}/swaps r,
 
-  # For systemd-analyze cat-config
-  /etc/systemd/** r,
-  /{usr/,}lib/systemd/** r,
-
-  @{sys}/fs/cgroup/{,**} r,
-  @{sys}/fs/cgroup/{systemd,unified}/**/cgroup.procs rw,
-  @{sys}/fs/cgroup/unified/**/init.scope/ rw,
-  @{sys}/firmware/acpi/tables/FPDT r,
-
-  @{sys}/module/**/uevent r,
-  @{sys}/devices/**/uevent r,
-  @{run}/udev/data/* r,
-
-  @{run}/udev/tags/systemd/ r,
-  @{run}/systemd/system/ r,
-  @{run}/systemd/userdb/io.systemd.DynamicUser w,
-
-  owner /tmp/systemd-temporary-*/ rw,
-
-  /usr/ r,
-
-  /etc/default/locale r,
-  /etc/locale.conf r,
-
-  @{sys}/firmware/efi/efivars/LoaderTimeInitUSec-@{uuid} r,
-  @{sys}/firmware/efi/efivars/LoaderTimeExecUSec-@{uuid} r,
-
   /dev/tty rw,
   /dev/pts/1 rw,
 

apparmor.d/groups/systemd/systemd-coredump

@@ -22,6 +22,8 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected) {
   capability sys_admin,
   capability sys_ptrace,
 
+  mount -> /,
+
   @{exec_path} mr,
 
   /{usr/,}bin/* r,
@@ -30,8 +32,6 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected) {
   /opt/** r,
   / r,
 
-  mount -> /,
-
   /etc/systemd/coredump.conf r,
 
         /var/lib/systemd/coredump/ r,