feat(profiles): minor improvments.

apparmor.d/groups/systemd/systemd-analyze

@@ -28,38 +28,35 @@ profile systemd-analyze @{exec_path} {
   /{usr/,}bin/more      rPx -> child-pager,
   /{usr/,}bin/man       rPx,
 
+  /usr/ r,
+  /{usr/,}lib/systemd/** r,
+
+  /etc/default/locale r,
+  /etc/locale.conf r,
+  /etc/systemd/** r,
+
+  owner /tmp/systemd-temporary-*/ rw,
+
+  @{run}/systemd/system/ r,
+  @{run}/systemd/userdb/io.systemd.DynamicUser w,
+  @{run}/udev/data/* r,
+  @{run}/udev/tags/systemd/ r,
+
+  @{sys}/devices/**/uevent r,
+  @{sys}/firmware/acpi/tables/FPDT r,
+  @{sys}/fs/cgroup/{,**} r,
+  @{sys}/fs/cgroup/{systemd,unified}/**/cgroup.procs rw,
+  @{sys}/fs/cgroup/unified/**/init.scope/ rw,
+  @{sys}/module/**/uevent r,
+
+  @{sys}/firmware/efi/efivars/LoaderTimeInitUSec-@{uuid} r,
+  @{sys}/firmware/efi/efivars/LoaderTimeExecUSec-@{uuid} r,
+
   owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/mountinfo r,
   owner @{PROC}/@{pid}/comm r,
         @{PROC}/swaps r,
 
-  # For systemd-analyze cat-config
-  /etc/systemd/** r,
-  /{usr/,}lib/systemd/** r,
-
-  @{sys}/fs/cgroup/{,**} r,
-  @{sys}/fs/cgroup/{systemd,unified}/**/cgroup.procs rw,
-  @{sys}/fs/cgroup/unified/**/init.scope/ rw,
-  @{sys}/firmware/acpi/tables/FPDT r,
-
-  @{sys}/module/**/uevent r,
-  @{sys}/devices/**/uevent r,
-  @{run}/udev/data/* r,
-
-  @{run}/udev/tags/systemd/ r,
-  @{run}/systemd/system/ r,
-  @{run}/systemd/userdb/io.systemd.DynamicUser w,
-
-  owner /tmp/systemd-temporary-*/ rw,
-
-  /usr/ r,
-
-  /etc/default/locale r,
-  /etc/locale.conf r,
-
-  @{sys}/firmware/efi/efivars/LoaderTimeInitUSec-@{uuid} r,
-  @{sys}/firmware/efi/efivars/LoaderTimeExecUSec-@{uuid} r,
-
   /dev/tty rw,
   /dev/pts/1 rw,
 

apparmor.d/groups/systemd/systemd-coredump

@@ -22,6 +22,8 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected) {
   capability sys_admin,
   capability sys_ptrace,
 
+  mount -> /,
+
   @{exec_path} mr,
 
   /{usr/,}bin/* r,
@@ -30,8 +32,6 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected) {
   /opt/** r,
   / r,
 
-  mount -> /,
-
   /etc/systemd/coredump.conf r,
 
         /var/lib/systemd/coredump/ r,