feat(profiles): apply rule from #51.

apparmor.d/groups/systemd/systemd-journald

@@ -47,14 +47,16 @@ profile systemd-journald @{exec_path} {
   @{run}/udev/data/+pci:*       r,
   @{run}/udev/data/+platform*   r,
   @{run}/udev/data/+scsi:*      r,
+  @{run}/udev/data/+sdio:*      r,
   @{run}/udev/data/+usb-serial:* r,
   @{run}/udev/data/+usb:*       r,
   @{run}/udev/data/+virtio:*    r,
-  @{run}/udev/data/+sdio:*      r,
+  @{run}/udev/data/c1:[0-9]*    r,
   @{run}/udev/data/c10:224      r, # for /dev/tpm0
   @{run}/udev/data/c189:[0-9]*  r, # for /dev/bus/usb/**
   @{run}/udev/data/c23[0-9]:[0-9]* r,
   @{run}/udev/data/c24[0-9]:[0-9]* r,
+  @{run}/udev/data/c4:[0-9]* r,
 
   @{sys}/devices/**/uevent r,
   @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,

apparmor.d/groups/systemd/systemd-makefs

@@ -9,7 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}lib/systemd/systemd-makefs
 profile systemd-makefs @{exec_path} {
   include <abstractions/base>
-  include <abstractions/disks-read>
+  include <abstractions/disks-write>
   include <abstractions/systemd-common>
 
   capability net_admin,

apparmor.d/profiles-m-r/mount-zfs

@@ -31,5 +31,9 @@ profile mount-zfs @{exec_path} flags=(complain) {
   umount /,
   umount /*/,
 
+  @{PROC}/@{pids}/mounts r,
+
+  /dev/zfs rw,
+
   include if exists <local/mount-zfs>
 }

apparmor.d/profiles-m-r/run-parts

@@ -79,6 +79,7 @@ profile run-parts @{exec_path} {
   /etc/network/if-up.d/ethtool               rPUx,
   /etc/network/if-up.d/ifenslave             rPUx,
   /etc/network/if-up.d/openvpn               rPUx,
+  /etc/network/if-up.d/postfix               rPUx,
   /etc/network/if-up.d/wpasupplicant         rPUx,
 
   # Motd

apparmor.d/profiles-s-z/sudo

@@ -13,6 +13,7 @@ profile sudo @{exec_path} {
   include <abstractions/app-launcher-root>
   include <abstractions/authentication>
   include <abstractions/consoles>
+  include <abstractions/dbus-strict>
   include <abstractions/nameservice-strict>
   include <abstractions/wutmp>
 # include <pam/mappings>
@@ -32,9 +33,13 @@ profile sudo @{exec_path} {
 
   ptrace (read),
 
-  # signal,
   signal (send) set=(cont,hup) peer=su,
 
+  dbus send bus=system path=/org/freedesktop/login[0-9]
+       interface=org.freedesktop.login[0-9].Manager
+       member=CreateSession
+       peer=(name=org.freedesktop.login[0-9]),
+
   @{exec_path} mr,
 
   /run/ r,

apparmor.d/profiles-s-z/switcheroo-control

@@ -29,6 +29,7 @@ profile switcheroo-control @{exec_path} flags=(attach_disconnected) {
   @{exec_path} mr,
 
   @{run}/udev/data/+drm:* r,
+  @{run}/udev/data/+pci:* r,
 
   @{run}/udev/data/c226:[0-9]* r,   # for /dev/dri/card* 
 

apparmor.d/profiles-s-z/udisksd

@@ -14,6 +14,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
   include <abstractions/dbus-strict>
   include <abstractions/disks-write>
   include <abstractions/nameservice-strict>
+  include <abstractions/openssl>
 
   capability chown,
   capability dac_override,