feat(openvpn): improve integration accross profiles.

See #157

apparmor.d/groups/gnome/gnome-control-center

@@ -128,6 +128,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
   /var/lib/AccountsService/icons/* r,
 
   owner @{HOME}/.cat_installer/ca.pem r,
+  owner @{HOME}/.cert/nm-openvpn/*.pem r,
   owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
   owner @{user_cache_dirs}/gnome-control-center/{,**} rw,
   owner @{user_cache_dirs}/thumbnails/{,**} rw,

apparmor.d/groups/network/nm-openvpn-auth-dialog

@@ -12,5 +12,7 @@ profile nm-openvpn-auth-dialog @{exec_path} {
 
   @{exec_path} mr,
 
+  owner @{HOME}/.cert/nm-openvpn/*.pem r,
+
   include if exists <local/nm-openvpn-auth-dialog>
 }

apparmor.d/groups/network/nm-openvpn-service-openvpn-helper

@@ -12,5 +12,7 @@ profile nm-openvpn-service-openvpn-helper @{exec_path} {
 
   @{exec_path} mr,
 
+  @{HOME}/.cert/nm-openvpn/*.pem r,
+
   include if exists <local/nm-openvpn-service-openvpn-helper>
 }

apparmor.d/groups/network/nmcli

@@ -17,6 +17,9 @@ profile nmcli @{exec_path} {
 
   /{usr/,}bin/less rCx -> pager,
 
+  owner @{HOME}/.nm-vpngate/*.ovpn r,
+  owner @{HOME}/.cert/nm-openvpn/*.pem rw,
+
   @{run}/udev/data/+pci* r,
   @{run}/udev/data/n[0-9]* r,
 

apparmor.d/groups/network/openvpn

@@ -1,6 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
-#               2021 Alexandre Pujol <alexandre@pujol.io>
+# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 #
 # The following profile assumes that:
@@ -23,7 +23,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}{s,}bin/openvpn
-profile openvpn @{exec_path} {
+profile openvpn @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
   include <abstractions/openssl>
@@ -50,14 +50,17 @@ profile openvpn @{exec_path} {
 
   @{exec_path} mr,
 
+  @{libexec}/{,NetworkManager/}nm-openvpn-service-openvpn-helper rPx,
+
   /etc/openvpn/{,**} r,
 
   @{HOME}/.cert/{,**} r,
 
   /var/log/openvpn/*.log w,
 
-  @{run}/openvpn/*.{pid,status} rw,
   @{run}/NetworkManager/nm-openvpn-@{uuid} rw,
+  @{run}/openvpn/*.{pid,status} rw,
+  @{run}/systemd/journal/dev-log rw,
 
   /{usr/,}{s,}bin/ip                            rix,
   /{usr/,}bin/systemd-ask-password              rPx,