Deny all access to virtual hard drives

etc/apparmor.d/abstractions/dangerous-files

@@ -133,9 +133,14 @@
   audit deny /usr/share/hardened-kernel/ rw,
   audit deny /usr/share/hardened-kernel/** rw,
 
-  ## Deny write access to hard drives. Otherwise, an attacker can write to
+  ## Deny all access to hard drives. Otherwise, an attacker can write to
   ## e.g. /dev/sda to bypass restrictions.
   audit deny /dev/sd* rw,
+  audit deny /dev/vd* rw,
+  audit deny /dev/disk/ rw,
+  audit deny /dev/disk/** rw,
+  audit deny /dev/block/ rw,
+  audit deny /dev/block/* rw,
 
   ## Deny access to /proc/kcore and /dev/core. /proc/kcore represents all
   ## physical memory of the system and /dev/core is a symlink to it.

etc/apparmor.d/abstractions/init-systemd

@@ -227,7 +227,6 @@
   /dev/kvm rw,
   owner /dev/sr0 rwk,
   /dev/log rw,
-  owner /dev/sd* r,
   owner /dev/kmsg rw,
   owner /dev/fb0 rw,
   owner /dev/vga_arbiter rw,
@@ -244,12 +243,7 @@
   owner /dev/char/[0-9]*:[0-9]* w,
   owner /dev/sg[0-9]* rwmk,
   owner /dev/ttyS[0-9]* rw,
-  owner /dev/disk/ r,
-  owner /dev/disk/by-path/pci-*-sas-phy[0-9]-lun-[0-9] w,
-  owner /dev/disk/by-path/pci-*-sas-phy[0-9]-lun-[0-9]-part[0-9] w,
-  owner /dev/disk/by-partuuid/[0-9]*-[0-9]* w,
   owner /dev/bsg/ r,
-  owner /dev/block/ r,
   owner /dev/hugepages/ rw,
   owner /dev/net/ r,
   owner /dev/mapper/ r,
@@ -261,7 +255,6 @@
   owner /dev/dm-0 rw,
   owner /dev/mapper/swapfile w,
   owner /dev/vport[0-9]* rw,
-  owner /dev/vda[0-9]* r,
   /dev/dri/card[0-9]* rw,
   owner /dev/bus/usb/ r,