s3fs: rework the profile.

apparmor.d/profiles-s-z/s3fs

@@ -24,16 +24,45 @@ profile s3fs @{exec_path} {
 
   @{exec_path} mr,
 
-  /{usr/,}bin/fusermount rPx,
+  /{usr/,}bin/fusermount{,3}  rCx -> fusermount,
 
+  /etc/mime.types r,
   /etc/passwd-s3fs r,
 
   owner @{HOME}/.passwd-s3fs r,
-  owner /tmp/* rw,
 
-  @{PROC}/sys/kernel/random/boot_id r,
+  owner @{MOUNTS}/*/ r,
+  owner @{MOUNTS}/*/*/ r,
+  owner /tmp/* rw,
 
   /dev/fuse rw,
 
+  profile fusermount {
+    include <abstractions/base>
+    include <abstractions/nameservice-strict>
+
+    capability sys_admin,
+
+    network inet stream,
+    network inet6 stream,
+
+    /{usr/,}bin/fusermount{,3} mr,
+
+    /etc/fuse.conf r,
+
+    @{MOUNTS}/*/ r,
+    @{MOUNTS}/*/*/ r,
+
+    mount fstype=fuse.s3fs -> @{MOUNTS}/*/,
+    mount fstype=fuse.s3fs -> @{MOUNTS}/*/*/,
+  
+    umount @{MOUNTS}/*/,
+    umount @{MOUNTS}/*/*/,
+  
+    @{PROC}/@{pids}/mounts r,
+
+    /dev/fuse rw,
+  }
+
   include if exists <local/s3fs>
 }