feat(profile): update arch profiles.

apparmor.d/groups/pacman/pacdiff

@@ -9,7 +9,6 @@ include <tunables/global>
 @{exec_path} = @{bin}/pacdiff
 profile pacdiff @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
-  include <abstractions/app/editor>
 
   capability dac_read_search,
   capability mknod,
@@ -20,17 +19,18 @@ profile pacdiff @{exec_path} flags=(attach_disconnected) {
   @{exec_path} mr,
 
   @{sh_path}          rix,
-  @{bin}/{m,g,}awk    rix,
-  @{bin}/cat          rix,
-  @{bin}/cmp          rix,
-  @{bin}/find         rix,
-  @{bin}/locate       rix,
-  @{bin}/pacman       rix,
-  @{bin}/pacman-conf  rPx,
-  @{bin}/pacsort      rix,
-  @{bin}/rm           rix,
-  @{bin}/sed          rix,
-  @{bin}/tput         rix,
+  @{bin}/{m,g,}awk     ix,
+  @{bin}/cat           ix,
+  @{bin}/cmp           ix,
+  @{bin}/find          ix,
+  @{bin}/locate        ix,
+  @{bin}/pacman        ix,
+  @{bin}/pacman-conf   Px,
+  @{bin}/pacsort       ix,
+  @{bin}/rm            ix,
+  @{bin}/sed           ix,
+  @{bin}/tput          ix,
+  @{editor_path}       Cx -> editor,
 
   # packages files
   / r,
@@ -44,6 +44,15 @@ profile pacdiff @{exec_path} flags=(attach_disconnected) {
   /dev/tty rw,
   /dev/pts/@{int} rw,
 
+  profile editor {
+    include <abstractions/base>
+    include <abstractions/app/editor>
+
+    /etc/** rw,
+
+    include if exists <local/pacdiff_editor>
+  }
+
   include if exists <local/pacdiff>
 }
 

apparmor.d/groups/pacman/pacman-hook-systemd

@@ -46,6 +46,8 @@ profile pacman-hook-systemd @{exec_path} {
     capability net_admin,
     capability sys_resource,
 
+    ptrace read peer=@{p_systemd},
+
     signal send set=(cont, term) peer=systemd-tty-ask-password-agent,
 
     @{bin}/systemd-tty-ask-password-agent Px,