First of all, the generated profile also gets generated as keyfile to
/run, thereby it looses the read-only flag (because this flag gets lost
when storing the profile to keyfile).

Second, I don't think we should artificially limit the capabilities
of the generated profile. If the user chooses to modify/delete it, so
just allow it.