Create lsblk AppArmor profile

debian/rules

@@ -9,6 +9,7 @@
 	dh $@ --with=config-package
 
 override_dh_install:
+	dh_apparmor --profile-name='bin.lsblk'
 	dh_apparmor --profile-name='usr.sbin.rsyslogd'
 	dh_apparmor --profile-name='kicksecure-shell-script'
 	dh_apparmor --profile-name='sbin.networking-aae'

etc/apparmor.d/bin.lsblk

@@ -0,0 +1,23 @@
+## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
+## See the file COPYING for copying conditions.
+
+#include <tunables/global>
+
+profile lsblk /{,usr/}bin/lsblk flags=(attach_disconnected) {
+  #include <abstractions/base>
+
+  /{,usr/}bin/lsblk mrix,
+
+  @{sys}/block/ r,
+  @{sys}/devices/pci**/block/{s,v}da/{,**} r,
+
+  @{PROC}/@{pids}/mount{s,info} r,
+  @{PROC}/swaps r,
+
+  /run/udev/data/* r,
+
+  owner /dev/pts/[0-9]* rw,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include if exists <local/bin.lsblk>
+}