lsblk profile: Minor fixes

Fixes: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2107402
Fixes: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2107455

Allow `/usr/bin/lsblk mr` to make this profile work from confined
profiles. Also, allow css devices to work properly with lsblk.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>

profiles/apparmor.d/lsblk

@@ -18,6 +18,8 @@ profile lsblk /usr/bin/lsblk {
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
 
+  /usr/bin/lsblk mr,
+
   @{sys}/block/ r,
   @{sys}/class/block/ r,
   @{sys}/dev/block/ r,
@@ -29,6 +31,9 @@ profile lsblk /usr/bin/lsblk {
   # Needed for disks over network e.g. Hyper-V VMs (including Azure), IBM Power, ...
   @{sys}/devices/**/host@{int}/** r,
 
+  # Needed for channel subsystem for IBM Z
+  @{sys}/devices/css[0-9]/** r,
+
   /dev/sr[0-9]* rk,
 
   @{run}/udev/data/** r,