feat(profiles): general update.

apparmor.d/groups/gnome/gnome-session-binary

@@ -157,6 +157,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
 
   /{usr/,}bin/aa-notify                                    rPx,
   /{usr/,}bin/baloo_file                                   rPx,
+  @{libexec}/baloo_file                                    rPx,
   /{usr/,}bin/blueman-applet                               rPx,
   /{usr/,}bin/firewall-applet                             rPUx,
   /{usr/,}bin/gnome-keyring-daemon                         rPx,

apparmor.d/groups/gnome/tracker-extract

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = @{libexec}/tracker-extract-3
-profile tracker-extract @{exec_path} {
+profile tracker-extract @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/dbus-session-strict>
   include <abstractions/dconf-write>

apparmor.d/groups/network/mullvad-daemon

@@ -40,6 +40,7 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) {
   "/opt/Mullvad VPN/resources/*" r,
 
   /etc/mullvad-vpn/{,*} r,
+  /etc/mullvad-vpn/@{uid} rw,
   /etc/mullvad-vpn/*.json rw,
   @{etc_rw}/resolv.conf rw,
   @{etc_rw}/resolv.conf.mullvadbackup rw,

apparmor.d/groups/ssh/ssh

@@ -27,6 +27,7 @@ profile ssh @{exec_path} {
   /{usr/,}bin/{,b,d,rb}ash  rix,
   /{usr/,}bin/{c,k,tc,z}sh  rix,
 
+  @{etc_ro}/ssh/ssh_config r,
   @{etc_ro}/ssh/sshd_config r,
   @{etc_ro}/ssh/sshd_config.d/{,*} r,
 

apparmor.d/groups/systemd/systemd-machine-id-setup

@@ -7,16 +7,24 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}bin/systemd-machine-id-setup
-profile systemd-machine-id-setup @{exec_path} {
+profile systemd-machine-id-setup @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
 
   capability dac_override,
+  capability setgid,
+  capability setuid,
+  capability sys_admin,
+  capability sys_chroot,
 
   ptrace (read),
 
+  mount /,
+  umount /etc/machine-id,
+
   @{exec_path} mr,
 
+  / r,
   /etc/machine-id rw,
   /etc/ r,
   /var/ r,
@@ -25,6 +33,7 @@ profile systemd-machine-id-setup @{exec_path} {
         @{PROC}/cmdline r,
         @{PROC}/sys/kernel/osrelease r,
   owner @{PROC}/@{pid}/stat r,
+  owner @{PROC}/@{pid}/setgroups r,
 
   include if exists <local/systemd-machine-id-setup>
 }

apparmor.d/groups/systemd/systemd-sleep-grub2

@@ -18,7 +18,11 @@ profile systemd-sleep-grub @{exec_path} {
 
   /etc/sysconfig/bootloader r,
 
+  /var/lib/nscd/passwd r,
+
   @{PROC}/@{pid}/maps r,
 
+  /dev/tty rw,
+
   include if exists <local/systemd-sleep-grub>
 }

apparmor.d/profiles-g-l/kmod

@@ -55,6 +55,7 @@ profile kmod @{exec_path} flags=(attach_disconnected) {
   owner @{user_build_dirs}/**/lib/modules/*/kernel/{,**/} r,
   owner @{user_build_dirs}/**/lib/modules/*/kernel/**/*.ko r,
 
+        @{run}/xtables.lock r,
   owner @{run}/tmpfiles.d/ w,
   owner @{run}/tmpfiles.d/static-nodes.conf w,
 

apparmor.d/profiles-g-l/logrotate

@@ -19,6 +19,7 @@ profile logrotate @{exec_path} flags=(attach_disconnected) {
   capability fsetid,
   capability setgid,
   capability setuid,
+  capability net_admin,
 
   audit deny capability net_admin,
 

apparmor.d/profiles-m-r/mount

@@ -54,6 +54,7 @@ profile mount @{exec_path} {
   # Mount iso/img files
   owner @{user_img_dirs}/{,**} rwk,
 
+        @{run}/ r,
   owner @{run}/mount/ rw,
   owner @{run}/mount/utab{,.*} rw,
   owner @{run}/mount/utab.lock wk,

apparmor.d/profiles-m-r/run-parts

@@ -162,7 +162,7 @@ profile run-parts @{exec_path} {
     /etc/lsb-release r,
     /etc/update-motd.d/[0-9]*-[a-z]* r,
 
-    /var/cache/motd-news r,
+    /var/cache/motd-news rw,
     /var/lib/update-notifier/updates-available r,
     /var/lib/ubuntu-advantage/messages/motd-esm-announce r,
 

apparmor.d/profiles-s-z/slirp4netns

@@ -23,7 +23,9 @@ profile slirp4netns @{exec_path} flags=(attach_disconnected) {
   mount,
   umount,
 
-  pivot_root oldroot=/tmp/old/ -> /tmp/,
+  pivot_root /tmp/**,
+  pivot_root /tmp/old/,
+  # pivot_root oldroot=/tmp/old/ -> /tmp/,
 
   @{exec_path} mr,
 
@@ -34,9 +36,6 @@ profile slirp4netns @{exec_path} flags=(attach_disconnected) {
         @{run}/user/@{uid}/netns/cni-* r,
   owner @{run}/user/@{uid}/libpod/tmp/slirp4netns-*.log r,
 
-  pivot_root /tmp/**,
-  pivot_root /tmp/old/,
-
   /dev/net/tun rw,
 
   include if exists <local/slirp4netns>

apparmor.d/profiles-s-z/steam

@@ -78,7 +78,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain)
   /{usr/,}bin/uname                  rix,
   /{usr/,}bin/which                  rix,
   /{usr/,}bin/xdg-icon-resource      rPx,
-  /{usr/,}bin/xdg-user-dir           rPx,
+  /{usr/,}bin/xdg-user-dir           rix,
   /{usr/,}bin/xz                     rix,
   /{usr/,}bin/zenity                 rix,
   /{usr/,}lib{32,64}/ld-linux.so*    rix,
@@ -135,6 +135,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain)
   owner @{user_config_dirs}/autostart/ r,
   owner @{user_config_dirs}/cef_user_data/{,**} r,
   owner @{user_config_dirs}/unity3d/{,**} rwk,
+  owner @{user_config_dirs}/user-dirs.dirs r,
 
   owner @{user_share_dirs}/ r,
   owner @{user_share_dirs}/applications/*.desktop w,

apparmor.d/profiles-s-z/sudo

@@ -87,6 +87,7 @@ profile sudo @{exec_path} {
 
   @{PROC}/@{pids}/cgroup r,
   @{PROC}/@{pids}/fd/ r,
+  @{PROC}/@{pids}/loginuid r,
   @{PROC}/@{pids}/stat r,
   @{PROC}/1/limits r,
   @{PROC}/sys/kernel/seccomp/actions_avail r,