update apparmor profiles

apparmor.d/abstractions/python

@@ -39,5 +39,8 @@
   # python build configuration and headers
   /usr/include/python{2.[4-7],3.[0-9]}*/pyconfig.h r,
 
+  # Silencer
+  /{usr/,}lib/python3/** w,
+
   # Include additions to the abstraction
   include if exists <abstractions/python.d>

apparmor.d/apt

@@ -67,7 +67,7 @@ profile apt @{exec_path} flags=(complain) {
   # Needed? (##FIXME##)
   capability kill,
   capability fsetid,
-  capability net_admin,
+  audit deny capability net_admin,
 
   signal (send) peer=apt-methods-*,
 

apparmor.d/apt-get

@@ -66,7 +66,7 @@ profile apt-get @{exec_path} flags=(complain) {
   # Needed? (##FIXME##)
   capability kill,
   capability fsetid,
-  capability net_admin,
+  audit deny capability net_admin,
 
   signal (send) peer=apt-methods-*,
 

apparmor.d/apt-systemd-daily

@@ -17,6 +17,10 @@ include <tunables/global>
 profile apt-systemd-daily @{exec_path} {
   include <abstractions/base>
 
+  # Needed to remove the following error:
+  # apt.systemd.daily[]: find: ‘/var/cache/apt/archives/partial’: Permission denied
+  capability dac_read_search,
+
   @{exec_path} mrix,
   /{usr/,}bin/{,ba,da}sh rix,
 
@@ -29,6 +33,7 @@ profile apt-systemd-daily @{exec_path} {
   /{usr/,}bin/which      rix,
   /{usr/,}bin/touch      rix,
   /{usr/,}bin/basename   rix,
+  /{usr/,}bin/dirname    rix,
   /{usr/,}bin/date       rix,
   /{usr/,}bin/find       rix,
   /{usr/,}bin/du         rix,
@@ -37,6 +42,8 @@ profile apt-systemd-daily @{exec_path} {
   /{usr/,}bin/uniq       rix,
   /{usr/,}bin/wc         rix,
   /{usr/,}bin/seq        rix,
+  /{usr/,}bin/xargs      rix,
+  /{usr/,}bin/gzip       rix,
 
   /{usr/,}bin/apt-config rPx,
   /{usr/,}bin/apt-get    rPx,
@@ -49,11 +56,18 @@ profile apt-systemd-daily @{exec_path} {
 
   /var/lib/apt/extended_states r,
 
-  /var/backups/apt.extended_states.[0-9]* r,
+  /var/backups/ r,
+  /var/backups/apt.extended_states rw,
+  /var/backups/apt.extended_states.[0-9]* rw,
+  /var/backups/apt.extended_states.[0-9]*.gz w,
 
   /var/cache/apt/ r,
   /var/cache/apt/archives/ r,
+  /var/cache/apt/archives/partial/ r,
+  /var/cache/apt/archives/*.deb rw,
   /var/cache/apt/backup/ r,
 
+  owner @{PROC}/@{pid}/fd/ r,
+
   include if exists <local/apt-systemd-daily>
 }

apparmor.d/aptitude

@@ -67,7 +67,7 @@ profile aptitude @{exec_path} flags=(complain) {
   capability kill,
   capability fsetid,
   capability sys_chroot,
-  capability net_admin,
+  audit deny capability net_admin,
   #capability sys_tty_config,
 
   signal (send) peer=apt-methods-*,

apparmor.d/birdtray

@@ -29,7 +29,9 @@ profile birdtray @{exec_path} {
   include <abstractions/ssl_certs>
   include <abstractions/deny-root-dir-access>
 
-  deny network netlink dgram,
+  network inet dgram,
+  network inet6 dgram,
+  network netlink dgram,
 
   @{exec_path} mr,
 

apparmor.d/bluetoothd

@@ -22,7 +22,8 @@ profile bluetoothd @{exec_path} {
   capability net_admin,
   capability net_bind_service,
 
-  network bluetooth,
+  network bluetooth raw,
+  network bluetooth seqpacket,
   network netlink raw,
 
   @{exec_path} mr,

apparmor.d/calibre

@@ -174,9 +174,6 @@ profile calibre @{exec_path} {
   /etc/inputrc r,
   /etc/magic r,
 
-  # Silencer
-  deny /usr/lib/python3/dist-packages/**.pyc.[0-9]* w,
-
   # file_inherit
   owner /dev/tty[0-9]* rw,
   owner @{HOME}/.xsession-errors w,

apparmor.d/check-bios-nx

@@ -43,9 +43,9 @@ profile check-bios-nx @{exec_path} {
 
     /etc/modprobe.d/ r,
     /etc/modprobe.d/*.conf r,
-    /usr/lib/modprobe.d/ r,
+    /{usr/,}lib/modprobe.d/ r,
-    /usr/lib/modprobe.d/*.conf r,
+    /{usr/,}lib/modprobe.d/*.conf r,
-    /usr/lib/modules/*/modules.* r,
+    /{usr/,}lib/modules/*/modules.* r,
 
     @{PROC}/cmdline r,
 

apparmor.d/check-support-status

@@ -14,15 +14,13 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}bin/check-support-status
-profile check-support-status @{exec_path} flags=(complain) {
+profile check-support-status @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
 
   @{exec_path} rix,
   /{usr/,}bin/{,ba,da}sh rix,
 
-  /etc/debian_version r,
-
   /{usr/,}bin/           r,
   /{usr/,}bin/gettext.sh r,
   /{usr/,}bin/cat        rix,
@@ -53,7 +51,12 @@ profile check-support-status @{exec_path} flags=(complain) {
 
   /{usr/,}bin/debconf-escape rCx -> debconf-escape,
 
+  /etc/debian_version r,
+
+  # For shell pwd
   / r,
+  owner @{HOME}/ r,
+
         /tmp/ r,
   owner /tmp/debian-security-support.*/{,**} rw,
         /tmp/debian-security-support.postinst.*/output w,
@@ -66,7 +69,7 @@ profile check-support-status @{exec_path} flags=(complain) {
   /usr/share/debian-security-support/* r,
 
 
-  profile debconf-escape flags=(complain) {
+  profile debconf-escape {
     include <abstractions/base>
     include <abstractions/perl>
 

apparmor.d/check-support-status-hook

@@ -14,7 +14,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /usr/share/debian-security-support/check-support-status.hook
-profile check-support-status-hook @{exec_path} flags=(complain) {
+profile check-support-status-hook @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
@@ -53,7 +53,7 @@ profile check-support-status-hook @{exec_path} flags=(complain) {
   /var/lib/debian-security-support/ r,
 
 
-  profile debconf-escape flags=(complain) {
+  profile debconf-escape {
     include <abstractions/base>
     include <abstractions/consoles>
     include <abstractions/perl>
@@ -66,7 +66,7 @@ profile check-support-status-hook @{exec_path} flags=(complain) {
 
   }
 
-  profile frontend flags=(complain) {
+  profile frontend {
     include <abstractions/base>
     include <abstractions/consoles>
     include <abstractions/perl>
@@ -98,7 +98,7 @@ profile check-support-status-hook @{exec_path} flags=(complain) {
 
   }
 
-  profile runuser flags=(complain) {
+  profile runuser {
     include <abstractions/base>
     include <abstractions/consoles>
     include <abstractions/nameservice-strict>

apparmor.d/dhclient

@@ -28,7 +28,7 @@ profile dhclient @{exec_path} {
   capability net_bind_service,
 
   # Needed?
-  #capability net_admin,
+  audit deny capability net_admin,
   audit deny capability sys_module,
 
   network inet dgram,

apparmor.d/dkms

@@ -58,7 +58,7 @@ profile dkms @{exec_path} {
   capability setuid,
   capability setgid,
   /proc/sys/kernel/osrelease r,
-  /usr/lib/linux-kbuild-*/tools/objtool/objtool rix,
+  /{usr/,}lib/linux-kbuild-*/tools/objtool/objtool rix,
 
   / r,
   /{usr/,}lib/modules/*/updates/ rw,

apparmor.d/engrampa

@@ -65,14 +65,19 @@ profile engrampa @{exec_path} {
   owner @{HOME}/.cache/ rw,
   owner @{HOME}/.cache/.fr-*/{,**} rw,
 
+  owner @{HOME}/.config/ r,
   owner @{HOME}/.config/mimeapps.list{,.*} rw,
 
   owner @{HOME}/.local/share/ r,
 
   /usr/share/engrampa/{,**} r,
 
+  /usr/share/**.desktop r,
+  /usr/share/**/icons/**.png r,
+
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
+  owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/fd/ r,
         @{PROC}/@{pid}/mountinfo r,
         @{PROC}/@{pid}/mounts r,

apparmor.d/exim4

@@ -19,27 +19,48 @@ profile exim4 @{exec_path} {
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
 
-  network inet,
+  network inet dgram,
-  network inet6,
+  network inet6 dgram,
+  network inet stream,
+  network inet6 stream,
   network netlink raw,
 
   @{exec_path} mrix,
 
+  # To bind to port 25/tcp
+  capability net_bind_service,
+
+  # To remove the following error:
+  #  exim4[]: exim: setgroups() failed: Operation not permitted
+  capability setgid,
+
+  # To remove the following error:
+  #  exim4[]: unable to set gid=110 or uid=105 (euid=0): calling tls_validate_require_cipher
+  capability setuid,
+
+  # To remove the following error:
+  # exim4[]: Cannot open main log file "/var/log/exim4/mainlog": Permission denied: euid=0 egid=110
   capability dac_read_search,
   capability dac_override,
-  capability setgid,
+
-  capability setuid,
+  # To remove the following error:
+  #  exim.c:774: chown(/var/spool/exim4//msglog//1kqH5Z-000RUf-UR, 105:110) failed (Operation not
+  #  permitted). Please contact the authors and refer to https://bugs.exim.org/show_bug.cgi?id=2391
   capability chown,
+
+  # To remove the following error:
+  #  Couldn't chmod message log /var/spool/exim4//msglog//1kqH6c-000S7r-Ni: Operation not permitted
   capability fowner,
-  capability net_bind_service,
+
-  # Sendmail
+  # Needed?
-  capability net_admin,
+  audit deny capability net_admin,
 
   /var/lib/exim4/config.autogenerated{,.tmp} r,
 
   /etc/email-addresses r,
   /etc/aliases r,
 
+  deny /var/log/exim4/ w,
   /var/log/exim4/mainlog w,
   /var/log/exim4/paniclog w,
 

apparmor.d/gajim

@@ -35,7 +35,7 @@ profile gajim @{exec_path} {
   network inet6 dgram,
   network inet stream,
   network inet6 stream,
-  deny network netlink raw,
+  network netlink raw,
 
   @{exec_path} r,
 

apparmor.d/gsimplecal

@@ -0,0 +1,26 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2020 Mikhail Morfikov
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/gsimplecal
+profile gsimplecal @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/gtk>
+  include <abstractions/fonts>
+  include <abstractions/fontconfig-cache-read>
+
+  @{exec_path} mr,
+
+  include if exists <local/gsimplecal>
+}

apparmor.d/hardinfo

@@ -123,7 +123,6 @@ profile hardinfo @{exec_path} {
 
   # Silencer
   deny /usr/share/gdb/python/** w,
-  deny /usr/lib/python3/** w,
 
   # file_inherit
   owner /dev/tty[0-9]* rw,

apparmor.d/htop

@@ -30,7 +30,7 @@ profile htop @{exec_path} {
   capability sys_ptrace,
 
   # Needed?
-  capability net_admin,
+  audit deny capability net_admin,
 
   signal (send),
   ptrace (read),

apparmor.d/iotop

@@ -19,7 +19,8 @@ profile iotop @{exec_path} {
   include <abstractions/python>
   include <abstractions/nameservice-strict>
 
-  capability net_admin,
+  # Needed?
+  audit deny capability net_admin,
 
   # To set processes' priorities
   capability sys_nice,

apparmor.d/ip

@@ -22,9 +22,8 @@ profile ip @{exec_path} flags=(attach_disconnected) {
   # To be able to manage network interfaces.
   capability net_admin,
 
-  #capability sys_admin,
-
   # Needed?
+  #capability sys_admin,
   audit deny capability sys_module,
 
   network netlink raw,

apparmor.d/kvm-ok

@@ -43,8 +43,8 @@ profile kvm-ok @{exec_path} {
 
     /etc/modprobe.d/ r,
     /etc/modprobe.d/*.conf r,
-    /usr/lib/modprobe.d/ r,
+    /{usr/,}lib/modprobe.d/ r,
-    /usr/lib/modprobe.d/*.conf r,
+    /{usr/,}lib/modprobe.d/*.conf r,
 
     @{PROC}/cmdline r,
 

apparmor.d/logrotate

@@ -27,7 +27,9 @@ profile logrotate @{exec_path} flags=(attach_disconnected, complain) {
   capability setuid,
   capability fsetid,
   capability fowner,
-  capability net_admin,
+
+  # Needed?
+  audit deny capability net_admin,
 
   @{exec_path} mr,
 

apparmor.d/macchanger

@@ -17,11 +17,13 @@ include <tunables/global>
 profile macchanger @{exec_path} {
   include <abstractions/base>
 
+  # To be able to set the MAC address:
+  #  [ERROR] Could not change MAC: interface up or insufficient permissions: Operation not permitted
   capability net_admin,
 
   network inet dgram,
   network inet6 dgram,
- 
+
   @{exec_path} mr,
 
   /usr/share/macchanger/*.list r,

apparmor.d/minitube

@@ -36,8 +36,8 @@ profile minitube @{exec_path} {
   network inet6 dgram,
   network inet stream,
   network inet6 stream,
-  deny network netlink dgram,
+  network netlink dgram,
-  deny network netlink raw,
+  network netlink raw,
 
   @{exec_path} mr,
 

apparmor.d/mpsyt

@@ -68,8 +68,5 @@ profile mpsyt @{exec_path} {
   owner /tmp/mpsyt-input* rw,
   owner /tmp/mpsyt-mpv*.sock rw,
 
-  # Silencer
-  /usr/lib/python3/** w,
-
   include if exists <local/mpsyt>
 }

apparmor.d/nft

@@ -18,6 +18,7 @@ profile nft @{exec_path} {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
 
+  # To be able to run the nft command.
   capability net_admin,
 
   network netlink raw,

apparmor.d/openbox

@@ -38,6 +38,7 @@ profile openbox @{exec_path} {
   /etc/xdg/openbox/* r,
 
   owner @{HOME}/ r,
+  owner @{HOME}/.config/openbox/ r,
   owner @{HOME}/.config/openbox/* r,
 
   owner @{HOME}/.config/obmenu-generator/icons/[0-9a-f]*.png r,

apparmor.d/openvpn

@@ -29,7 +29,11 @@ profile openvpn @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/openssl>
 
+  # Needed to remove the following errors:
+  #  ERROR: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1)
+  #  Exiting due to fatal error
   capability net_admin,
+
   # These are needed when user/group are set in a OpenVPN config file
   capability setuid,
   capability setgid,
@@ -75,6 +79,7 @@ profile openvpn @{exec_path} {
     include <abstractions/consoles>
     include <abstractions/nameservice-strict>
 
+    # To be able to manage firewall rules.
     capability net_admin,
 
     /etc/openvpn/update-resolv-conf.sh r,
@@ -95,6 +100,7 @@ profile openvpn @{exec_path} {
     include <abstractions/consoles>
     include <abstractions/nameservice-strict>
 
+    # To be able to manage firewall rules.
     capability net_admin,
 
     network netlink raw,

apparmor.d/picom

@@ -0,0 +1,46 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2020 Mikhail Morfikov
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/picom{,-trans}
+profile picom @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/dri-common>
+  include <abstractions/nameservice-strict>
+  include <abstractions/mesa-cache-write>
+  include <abstractions/deny-root-dir-access>
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/sed      rix,
+  /{usr/,}bin/xargs    rix,
+  /{usr/,}bin/{,e}grep rix,
+  /{usr/,}bin/echo     rix,
+
+  # For migrating from compton.
+  owner @{HOME}/.config/compton.conf r,
+
+  owner @{HOME}/.config/picom.conf r,
+
+  owner @{HOME}/.Xauthority r,
+
+  @{sys}/devices/pci[0-9]*/**/{uevent,vendor,device,subsystem_vendor,subsystem_device} r,
+
+  owner @{PROC}/@{pid}/fd/ r,
+
+  # file_inherit
+  owner /dev/tty[0-9]* rw,
+
+  include if exists <local/picom>
+}

apparmor.d/polkitd

@@ -22,8 +22,8 @@ profile polkitd @{exec_path} {
   capability setuid,
   capability setgid,
 
-  # What's this for?
+  # Needed?
-  capability net_admin,
+  audit deny capability net_admin,
 
   @{exec_path} mr,
 

apparmor.d/psi-plus

@@ -40,7 +40,7 @@ profile psi-plus @{exec_path} {
   network inet6 dgram,
   network inet stream,
   network inet6 stream,
-  deny network netlink dgram,
+  network netlink dgram,
 
   @{exec_path} mr,
 

apparmor.d/qbittorrent

@@ -41,8 +41,8 @@ profile qbittorrent @{exec_path} {
   network inet6 dgram,
   network inet stream,
   network inet6 stream,
-  deny network netlink dgram,
+  network netlink dgram,
-  deny network netlink raw,
+  network netlink raw,
 
   @{exec_path} mr,
 

apparmor.d/qbittorrent-nox

@@ -27,8 +27,8 @@ profile qbittorrent-nox @{exec_path} {
   network inet6 dgram,
   network inet stream,
   network inet6 stream,
-  deny network netlink dgram,
+  network netlink dgram,
-  deny network netlink raw,
+  network netlink raw,
 
   @{exec_path} mr,
 

apparmor.d/qnapi

@@ -68,8 +68,8 @@ profile qnapi @{exec_path} {
   network inet6 dgram,
   network inet stream,
   network inet6 stream,
-  deny network netlink raw,
+  network netlink raw,
-  deny network netlink dgram,
+  network netlink dgram,
 
   @{exec_path} mr,
 

apparmor.d/reportbug

@@ -96,9 +96,6 @@ profile reportbug @{exec_path} {
   # Allowed apps to open
   /{usr/,}lib/firefox/firefox rPUx,
 
-  # Silencer
-  /usr/lib/python3/** w,
-
 
   profile run-parts {
     include <abstractions/base>

apparmor.d/rsyslogd

@@ -23,17 +23,19 @@ profile rsyslogd @{exec_path} {
   include <abstractions/base>
   include <abstractions/nameservice>
 
+  # Needed to remove the following error:
+  # rsyslogd[]: imklog: cannot open kernel log (/proc/kmsg): Operation not permitted.
   capability syslog,
 
-  # for remote logs
+  # For remote logs
   capability net_admin,
 
-  # Needed?
-  deny capability sys_nice,
-
   # for creating new log files and changing their owner/group
   capability chown,
 
+  # Needed?
+  deny capability sys_nice,
+
   @{exec_path} mr,
 
   /{usr/,}lib/@{multiarch}/rsyslog/*.so mr,

apparmor.d/smartd

@@ -25,7 +25,8 @@ profile smartd @{exec_path} {
   #  Device: /dev/disk/by-id/ata-*, not available
   capability sys_rawio,
 
-  capability net_admin,
+  # Needed?
+  deny capability net_admin,
 
   @{exec_path} mr,
 

apparmor.d/smtube

@@ -33,8 +33,8 @@ profile smtube @{exec_path} {
   network inet6 dgram,
   network inet stream,
   network inet6 stream,
-  deny network netlink dgram,
+  network netlink dgram,
-  deny network netlink raw,
+  network netlink raw,
 
   @{exec_path} mr,
 

apparmor.d/spacefm

@@ -57,6 +57,9 @@ profile spacefm @{exec_path} {
   @{sys}/devices/system/node/ r,
   @{sys}/devices/system/node/node[0-9]*/meminfo r,
 
+  @{sys}/fs/cgroup/**/cpu.cfs_quota_us r,
+  @{sys}/fs/cgroup/**/cpu.cfs_period_us r,
+
   # To read/write files in the system. The read permission is granted for all files, the write
   # permission only for the owner. Also, dirs like /dev/, /efi/, /proc/, /sys/ are not included in
   # the list.

apparmor.d/strawberry

@@ -40,8 +40,8 @@ profile strawberry @{exec_path} {
   network inet6 dgram,
   network inet stream,
   network inet6 stream,
-  deny network netlink dgram,
+  network netlink dgram,
-  deny network netlink raw,
+  network netlink raw,
 
   @{exec_path} mr,
 

apparmor.d/sudo

@@ -38,6 +38,12 @@ profile sudo @{exec_path} {
   # Needed? (#FIXME#)
   capability sys_resource,
 
+  # To remove the following error:
+  #  sudo: PAM account management error: Permission denied
+  #  sudo: unable to open audit system: Permission denied
+  #  sudo: a password is required
+  network netlink raw,
+
   signal,
 
   @{exec_path} mr,

apparmor.d/systemd-ac-power

@@ -0,0 +1,29 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2018-2020 Mikhail Morfikov
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}lib/systemd/systemd-ac-power
+profile systemd-ac-power @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  owner @{PROC}/@{pid}/stat r,
+
+  @{sys}/class/power_supply/ r,
+
+  @{sys}/devices/**/power_supply/{AC,BAT[0-9]*}/ r,
+  @{sys}/devices/**/power_supply/{AC,BAT[0-9]*}/{type,online} r,
+
+}

apparmor.d/systemd-backlight

@@ -0,0 +1,49 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2018-2020 Mikhail Morfikov
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}lib/systemd/systemd-backlight
+profile systemd-backlight @{exec_path} flags=(complain) {
+  include <abstractions/base>
+  include <abstractions/systemd-common>
+
+  # Needed?
+  deny capability net_admin,
+
+  @{exec_path} mr,
+
+  @{sys}/bus/ r,
+  @{sys}/class/ r,
+  @{sys}/class/backlight/ r,
+
+  @{sys}/devices/pci[0-9]*/**/class r,
+  @{sys}/devices/pci[0-9]*/**/backlight/**/brightness rw,
+  @{sys}/devices/pci[0-9]*/**/backlight/**/{max_brightness,actual_brightness} r,
+  @{sys}/devices/pci[0-9]*/**/backlight/**/{uevent,type} r,
+  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/brightness rw,
+  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/{max_brightness,actual_brightness} r,
+  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/{uevent,type} r,
+
+  @{sys}/devices/platform/**/leds/*backlight*/uevent r,
+  @{sys}/devices/platform/**/leds/*backlight*/max_brightness r,
+  @{sys}/devices/platform/**/leds/*backlight*/brightness rw,
+
+
+  @{run}/udev/data/+backlight:* r,
+  @{run}/udev/data/+leds:*backlight* r,
+
+  /var/lib/systemd/backlight/*backlight* rw,
+
+}
+

apparmor.d/systemd-detect-virt

@@ -0,0 +1,29 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2020 Mikhail Morfikov
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/systemd-detect-virt
+profile systemd-detect-virt @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/systemd-common>
+
+  @{exec_path} mr,
+
+  @{sys}/devices/virtual/dmi/id/product_name r,
+  @{sys}/devices/virtual/dmi/id/sys_vendor r,
+  @{sys}/devices/virtual/dmi/id/board_vendor r,
+  @{sys}/devices/virtual/dmi/id/bios_vendor r,
+
+  include if exists <local/systemd-detect-virt>
+}

apparmor.d/systemd-fsck

@@ -14,15 +14,17 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}lib/systemd/systemd-fsck
-profile systemd-fsck @{exec_path} flags=(complain) {
+profile systemd-fsck @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/disks-read>
   include <abstractions/systemd-common>
 
-  capability net_admin,
   capability sys_resource,
 
+  # Needed?
+  deny capability net_admin,
+
   @{exec_path} mr,
 
   /{usr/,}sbin/fsck   rPx,

apparmor.d/systemd-fsckd

@@ -14,14 +14,16 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}lib/systemd/systemd-fsckd
-profile systemd-fsckd @{exec_path} flags=(complain) {
+profile systemd-fsckd @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/systemd-common>
 
-  capability net_admin,
   capability sys_tty_config,
 
+  # Needed?
+  deny capability net_admin,
+
   @{exec_path} mr,
 
   owner @{run}/systemd/fsck.progress w,

apparmor.d/systemd-hostnamed

@@ -0,0 +1,35 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2018-2020 Mikhail Morfikov
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}lib/systemd/systemd-hostnamed
+profile systemd-hostnamed @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/systemd-common>
+
+  # To set a hostname
+  capability sys_admin,
+
+  @{exec_path} mr,
+
+  @{sys}/devices/virtual/dmi/id/product_name r,
+  @{sys}/devices/virtual/dmi/id/sys_vendor r,
+  @{sys}/devices/virtual/dmi/id/board_vendor r,
+  @{sys}/devices/virtual/dmi/id/bios_vendor r,
+  @{sys}/devices/virtual/dmi/id/chassis_type r,
+
+  /etc/hostname rw,
+  /etc/.#hostname* rw,
+
+}

apparmor.d/systemd-localed

@@ -0,0 +1,34 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2018-2020 Mikhail Morfikov
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}lib/systemd/systemd-localed
+profile systemd-localed @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+  include <abstractions/systemd-common>
+
+  # Needed?
+  audit deny capability net_admin,
+
+  @{exec_path} mr,
+
+  /etc/default/keyboard r,
+
+  /etc/default/locale rw,
+  /etc/default/.#locale* rw,
+
+  /usr/share/systemd/language-fallback-map r,
+
+}

apparmor.d/systemd-modules-load

@@ -21,7 +21,8 @@ profile systemd-modules-load @{exec_path} {
   # To load kernel modules
   capability sys_module,
 
-  capability net_admin,
+  # Needed?
+  audit deny capability net_admin,
 
   @{exec_path} mr,
 

apparmor.d/systemd-rfkill

@@ -18,7 +18,8 @@ profile systemd-rfkill @{exec_path} {
   include <abstractions/base>
   include <abstractions/systemd-common>
 
-  capability net_admin,
+  # Needed?
+  audit deny capability net_admin,
 
   network netlink raw,
 

apparmor.d/telegram-desktop

@@ -40,8 +40,8 @@ profile telegram-desktop @{exec_path} {
   network inet6 dgram,
   network inet stream,
   network inet6 stream,
-  deny network netlink dgram,
+  network netlink dgram,
-  deny network netlink raw,
+  network netlink raw,
 
   @{exec_path} mr,
 

apparmor.d/tint2

@@ -22,7 +22,7 @@ profile tint2 @{exec_path} {
   include <abstractions/deny-root-dir-access>
   include <abstractions/app-launcher-user>
 
-  deny network netlink dgram,
+  network netlink dgram,
 
   @{exec_path} mr,
 

apparmor.d/wavemon

@@ -20,6 +20,12 @@ profile wavemon @{exec_path} {
   # To scan WiFi networks
   capability net_admin,
 
+  network inet dgram,
+  network inet6 dgram,
+  # Needed to remove the following error:
+  #  wavemon: failed to connect to GeNetlink: Permission denied
+  network netlink raw,
+
   @{exec_path} mr,
 
   owner @{HOME}/.wavemonrc rw,

apparmor.d/wrmsr

@@ -14,7 +14,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path}  = /{usr/,}sbin/wrmsr
-profile wrmsr @{exec_path} flags=(complain) {
+profile wrmsr @{exec_path} {
   include <abstractions/base>
 
   # To access /dev/cpu/*/msr .