feat(profile): general update.

apparmor.d/groups/apt/apt

@@ -221,27 +221,15 @@ profile apt @{exec_path} flags=(attach_disconnected) {
 
   profile systemctl {
     include <abstractions/base>
-    include <abstractions/consoles>
+    include <abstractions/systemctl>
 
     capability net_admin,
     capability sys_resource,
 
-    ptrace (read),
-
-    @{bin}/systemctl mr,
-
-    @{bin}/systemd-tty-ask-password-agent rix,
+    @{bin}/systemd-tty-ask-password-agent rPx,
 
     owner @{run}/systemd/ask-password-block/{,*} rw,
     owner @{run}/systemd/ask-password/ rw,
-    owner @{run}/systemd/private rw,
-
-          @{PROC}/1/environ r,
-          @{PROC}/1/sched r,
-          @{PROC}/cmdline r,
-          @{PROC}/sys/kernel/osrelease r,
-    owner @{PROC}/@{pid}/fd/ r,
-    owner @{PROC}/@{pid}/stat r,
 
     /dev/kmsg w,
 

apparmor.d/groups/apt/command-not-found

@@ -23,6 +23,8 @@ profile command-not-found @{exec_path} {
   @{bin}/lsb_release rPx -> lsb_release,
   @{bin}/snap rPUx,
 
+  @{lib}/python3/dist-packages/CommandNotFound/**/__pycache__/*.cpython-@{int}.pyc.@{int} w,
+
   /var/lib/command-not-found/commands.db rwk,
 
   /usr/share/command-not-found/{,**} r,

apparmor.d/groups/freedesktop/at-spi-bus-launcher

@@ -29,8 +29,9 @@ profile at-spi-bus-launcher @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
-  @{bin}/dbus-broker-launch rPUx,
+  @{bin}/dbus-broker-launch  rix,
   @{bin}/dbus-daemon         rix,
+  @{bin}/dbus-broker         rix,
   @{lib}/at-spi2-registryd   rPx,
 
   /usr/share/dbus-1/accessibility-services/ r,

apparmor.d/groups/freedesktop/polkit-kde-authentication-agent

@@ -38,6 +38,8 @@ profile polkit-kde-authentication-agent @{exec_path} flags=(attach_disconnected)
 
   owner @{user_config_dirs}/qt5ct/{,**} r,
 
+  owner @{user_cache_dirs}/icon-cache.kcache rw,
+
   owner /tmp/#@{int} rw,
   owner /tmp/polkit-kde-authentication-agent-[0-9].* rwl -> /tmp/#@{int},
   # owner /tmp/xauth_@{rand6} r,

apparmor.d/groups/network/tailscaled

@@ -88,19 +88,13 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) {
 
   profile systemctl {
     include <abstractions/base>
+    include <abstractions/systemctl>
 
     capability mknod,
     capability net_admin,
   
     network netlink raw,
 
-    ptrace (read),
-
-    @{bin}/systemctl mr,
-
-    @{PROC}/ r,
-    @{PROC}/@{pid}/fd/ r,
-
     /dev/net/tun rw,
 
     include if exists <local/tailscaled_systemctl>

apparmor.d/groups/pacman/mkinitcpio

@@ -89,11 +89,12 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) {
 
   # Can copy any program to the initframs
   /{usr/,}{local/,}{s,}bin/ r,
-  @{bin}/[a-z0-9]* mr,
+  @{bin}/* mr,
+  @{bin}/*/ r,
   @{lib}/ r,
   @{lib}/plymouth/plymouthd-* mr,
   @{lib}/systemd/{,**} mr,
-  @{lib}/udev/[a-z0-9]* mr,
+  @{lib}/udev/* mr,
 
   # Manage /boot
   / r,

apparmor.d/groups/pacman/pacman-hook-mkinitcpio

@@ -64,7 +64,7 @@ profile pacman-hook-mkinitcpio @{exec_path} flags=(attach_disconnected) {
     /etc/pacman.d/{,**} r,
     /etc/pacman.d/gnupg/** rwkl,
 
-    /var/lib/pacman/local/{,**} r,
+    /var/lib/pacman/{,**} r,
 
     include if exists <local/pacman-hook-mkinitcpio_pacman>
   }

apparmor.d/groups/systemd/systemd-userdbd

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = @{lib}/systemd/systemd-userdbd
-profile systemd-userdbd @{exec_path} flags=(attach_disconnected) {
+profile systemd-userdbd @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
   include <abstractions/systemd-common>

apparmor.d/groups/ubuntu/update-notifier

@@ -52,7 +52,7 @@ profile update-notifier @{exec_path} {
   @{bin}/pkexec                                  rPx, # TODO: rCx or rix to run /usr/lib/update-notifier/package-system-locked
   @{bin}/snap                                   rPUx,
   @{bin}/software-properties-gtk                 rPx,
-  @{bin}/systemctl                               rPx -> child-systemctl,
+  @{bin}/systemctl                               rCx -> systemctl,
   @{bin}/update-manager                          rPx,
   @{lib}/ubuntu-release-upgrader/check-new-release-gtk rPx,
   @{lib}/update-notifier/apt_check.py            rix,
@@ -84,5 +84,18 @@ profile update-notifier @{exec_path} {
         @{PROC}/@{pids}/mountinfo r,
   owner @{PROC}/@{pid}/fd/ r,
 
+  profile systemctl {
+    include <abstractions/base>
+    include <abstractions/systemctl>
+    include <abstractions/bus-system>
+
+    dbus send bus=system path=/org/freedesktop/systemd1
+         interface=org.freedesktop.systemd1.Manager
+         member=GetUnitFileState
+         peer=(name=org.freedesktop.systemd1, label="@{systemd}"),
+
+    include if exists <local/update-notifier_systemctl>
+  }
+
   include if exists <local/update-notifier>
 }

apparmor.d/groups/whonix/torbrowser-wrapper

@@ -46,10 +46,8 @@ profile torbrowser-wrapper @{exec_path} {
 
   profile systemctl {
     include <abstractions/base>
-    include <abstractions/systemd-common>
+    include <abstractions/systemctl>
 
-    @{bin}/systemctl mr,
-  
     /etc/machine-id r,
 
     /{run,var}/log/journal/ r,