feat(profiles): general update.

apparmor.d/groups/apt/unattended-upgrade

@@ -7,30 +7,43 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}bin/unattended-upgrade
-profile unattended-upgrade @{exec_path} {
+profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
+  include <abstractions/openssl>
   include <abstractions/python>
+  include <abstractions/consoles>
 
   capability chown,
   capability dac_override,
   capability dac_read_search,
+  capability fsetid,
   capability kill,
+  capability net_admin,
   capability setgid,
   capability setuid,
   capability sys_nice,
 
+  network netlink raw,
+
   @{exec_path} mr,
 
   /{usr/,}bin/ r,
 
-  /{usr/,}{s,}bin/on_ac_power       rPx,
-  /{usr/,}bin/dpkg                  rPx,
-  /{usr/,}bin/lsb_release           rPx -> lsb_release,
-  /{usr/,}bin/python3.[0-9]*        rix,
-  /{usr/,}bin/uname                 rix,
-  /{usr/,}lib/apt/methods/http{,s}  rPx,
+  /{usr/,}{s,}bin/dpkg-preconfigure    rPx,
+  /{usr/,}{s,}bin/on_ac_power          rPx,
+  /{usr/,}{s,}bin/sendmail             rPUx,
+  /{usr/,}bin/{,ba,da}sh               rix,
+  /{usr/,}bin/apt-listchanges          rPx,
+  /{usr/,}bin/dpkg                     rPx,
+  /{usr/,}bin/etckeeper                rPx,
+  /{usr/,}bin/lsb_release              rPx -> lsb_release,
+  /{usr/,}bin/python3.[0-9]*           rix,
+  /{usr/,}bin/uname                    rix,
+  /{usr/,}lib/apt/methods/http{,s}     rPx,
+  /{usr/,}lib/needrestart/apt-pinvoke  rPx,
 
+  /usr/share/distro-info/* r,
   /usr/share/dpkg/*table r,
 
   /etc/apt/*.list r,
@@ -50,11 +63,16 @@ profile unattended-upgrade @{exec_path} {
   /var/lib/dpkg/status r,
   /var/lib/dpkg/updates/ r,
 
-  /var/cache/apt/archives/{,**} rw,
-  /var/cache/apt/pkgcache.bin r,
+  /var/cache/apt/{,**} rwk,
+  /var/lib/apt/extended_states{,.*} rw,
+  /var/log/apt/{term,history}.log w,
+  /var/log/apt/eipp.log.xz w,
 
-  owner @{run}/unattended-upgrades.pid rw,
   owner @{run}/unattended-upgrades.lock rwk,
+  owner @{run}/unattended-upgrades.pid rw,
+  owner @{run}/unattended-upgrades.progress rw,
+        @{run}/systemd/inhibit/[0-9]*.ref rw,
+        @{run}/resolvconf/resolv.conf r,
 
   owner /tmp/#[0-9]* rw,
 

apparmor.d/groups/gvfs/gvfsd

@@ -20,6 +20,7 @@ profile gvfsd @{exec_path} {
 
   /usr/share/gvfs/{,**} r,
 
+  owner @{run}/user/@{uid}/bus rw,
   owner @{run}/user/@{uid}/gvfs/ rw,
   owner @{run}/user/@{uid}/gvfsd/ rw,
 

apparmor.d/groups/network/nm-dhcp-helper

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}lib/nm-dhcp-helper
 profile nm-dhcp-helper @{exec_path} {
   include <abstractions/base>
+  include <abstractions/dbus>
 
   network inet dgram,
   network inet6 dgram,

apparmor.d/groups/pacman/mkinitcpio

@@ -54,6 +54,8 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) {
   /{usr/,}bin/{kmod,lsmod}        rPx,
   /{usr/,}bin/{modinfo,rmmod}     rPx,
   /{usr/,}bin/modprobe            rPx,
+  /{usr/,}bin/plymouth            rPx,
+  /{usr/,}bin/plymouth-set-default-theme rPx,
 
   /{usr/,}lib/initcpio/busybox    rix,
   /{usr/,}lib{,32,64}/ld-*.so*    rix,
@@ -64,16 +66,20 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) {
   /etc/mkinitcpio.conf r,
   /etc/mkinitcpio.d/{,**} r,
   /etc/modprobe.d/{,*} r,
+  /etc/plymouth/plymouthd.conf r,
   /etc/vconsole.conf r,
 
   /usr/share/kbd/keymaps/{,**} r,
+  /usr/share/plymouth/plymouthd.defaults r,
+  /usr/share/plymouth/themes/{,**} r,
   /usr/share/terminfo/x/xterm-256color r,
 
   # Can copy any program to the initframs
   /{usr/,}bin/ r,
   /{usr/,}bin/[a-z0-9]* rm,
-  /{usr/,}lib/udev/[a-z0-9]* rm,
+  /{usr/,}lib/plymouth/plymouthd-* rm,
   /{usr/,}lib/systemd/systemd-* rm,
+  /{usr/,}lib/udev/[a-z0-9]* rm,
 
   # Manage /boot
   / r,

apparmor.d/groups/pacman/pacman-conf

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}bin/pacman-conf
 profile pacman-conf @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/consoles>
 
   network inet stream,
   network inet6 stream,

apparmor.d/groups/systemd/systemd-localed

@@ -11,6 +11,7 @@ include <tunables/global>
 profile systemd-localed @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
+  include <abstractions/dbus-strict>
   include <abstractions/systemd-common>
 
   # Needed?

apparmor.d/groups/systemd/systemd-tmpfiles

@@ -39,6 +39,7 @@ profile systemd-tmpfiles @{exec_path} flags=(attach_disconnected) {
   /dev/{,**} rw,
   /etc/{,**} r,
   /home/ rw,
+  /opt/{,**} rw,
   /run/{,**} rw,
   /srv/{,**} rw,
   /tmp/{,**} rwk,
@@ -50,6 +51,7 @@ profile systemd-tmpfiles @{exec_path} flags=(attach_disconnected) {
 
   @{PROC}/@{pid}/net/unix r,
   @{PROC}/1/cmdline r,
+  @{PROC}/sched_debug w,
 
   deny /apparmor/.null rw,
 

apparmor.d/profiles-g-l/logrotate

@@ -20,7 +20,6 @@ profile logrotate @{exec_path} flags=(attach_disconnected, complain) {
   capability setgid,
   capability setuid,
 
-  # Needed?
   audit deny capability net_admin,
 
   signal (send) set=(hup),