Merge branch 'ubuntu2204__2' of https://github.com/nobodysu/apparmor.d into nobodysu-ubuntu2204__2

* 'ubuntu2204__2' of https://github.com/nobodysu/apparmor.d:
  Update pkexec
  Update polkitd
  update
  polishing
  polishing
  Ubuntu 22.04, second batch

apparmor.d/groups/apps/vlc

@@ -70,6 +70,13 @@ profile vlc @{exec_path} {
   include <abstractions/private-files-strict>
   include <abstractions/ssl_certs>
   include <abstractions/devices-usb>
+  include <abstractions/dbus-session-strict>
+  include <abstractions/dbus-gtk>
+  include <abstractions/dconf-write>
+  include <abstractions/ibus>
+
+#  capability sys_ptrace,
+#  ptrace (read),
 
   signal (receive) set=(term, kill) peer=anyremote//*,
 
@@ -79,6 +86,120 @@ profile vlc @{exec_path} {
   network inet6 stream,
   network netlink raw,
 
+  dbus (send) bus=session path=/org/freedesktop/DBus 
+       interface=org.freedesktop.DBus
+       member={RequestName,ReleaseName,GetConnectionUnixProcessID}
+       peer=(name=org.freedesktop.DBus),
+
+  dbus (receive) bus=session path=/org/freedesktop/Notifications
+       interface=org.freedesktop.Notifications
+       member=NotificationClosed
+       peer=(name=:*),
+
+  dbus (send) bus=session path=/org/a11y/bus
+       interface=org.freedesktop.DBus.Properties
+       member=Get
+       peer=(name=org.a11y.Bus),
+
+  dbus (send) bus=session path=/StatusNotifierWatcher
+       interface=org.freedesktop.DBus.Introspectable
+       member=Introspect
+       peer=(name=org.kde.StatusNotifierWatcher),
+
+  dbus (send) bus=session path=/StatusNotifierWatcher
+       interface=org.freedesktop.DBus.Properties
+       member={Get,RegisterStatusNotifierItem}
+       peer=(name=org.kde.StatusNotifierWatcher),
+
+  dbus (send) bus=session path=/StatusNotifierWatcher
+       interface=org.kde.StatusNotifierWatcher
+       member=RegisterStatusNotifierItem
+       peer=(name=org.kde.StatusNotifierWatcher),
+
+  dbus (send) bus=session path=/StatusNotifierItem 
+       interface=org.kde.StatusNotifierItem
+       member={NewToolTip,NewStatus,NewAttentionIcon,NewTitle,NewStatus,NewIcon}
+       peer=(name=org.freedesktop.DBus),
+
+  dbus (receive) bus=session path=/StatusNotifierItem 
+       interface=org.kde.StatusNotifierItem
+       member=Activate
+       peer=(name=:*),
+
+  dbus (receive) bus=session path=/StatusNotifierItem
+       interface=org.freedesktop.DBus.Properties
+       member={Get,GetAll}
+       peer=(name=:*),
+
+  dbus (send) bus=session path=/ScreenSaver
+       interface=org.freedesktop.ScreenSaver
+       member={Inhibit,UnInhibit}
+       peer=(name=org.freedesktop.ScreenSaver),
+
+  dbus (receive) bus=session path=/MenuBar
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=:*),
+
+  dbus (send) bus=session path=/MenuBar
+       interface=com.canonical.dbusmenu
+       member={LayoutUpdated,ItemsPropertiesUpdated}
+       peer=(name=org.freedesktop.DBus),
+
+  dbus (receive) bus=session path=/MenuBar
+       interface=com.canonical.dbusmenu
+       member={GetLayout,GetGroupProperties,AboutToShow,AboutToShowGroup,EventGroup,Event}
+       peer=(name=:*),
+
+  dbus (send, receive) bus=session path=/org/mpris/MediaPlayer2
+       interface=org.freedesktop.DBus.Properties
+       peer=(name="{org.freedesktop.DBus,:*}"), # all members
+
+  dbus (send, receive) bus=session path=/org/mpris/MediaPlayer2
+       interface=org.mpris.MediaPlayer2.*
+       peer=(name="{org.mpris.MediaPlayer2.vlc,:*,org.freedesktop.DBus}"), # all members
+
+#  dbus (send) bus=system path=/
+#       interface=org.freedesktop.DBus.Peer
+#       member=Ping,
+#       peer=(name="org.freedesktop.Avahi"),
+
+  dbus (send) bus=accessibility path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus
+       member={Hello,AddMatch,RemoveMatch}
+       peer=(name=org.freedesktop.DBus),
+
+  dbus (send) bus=accessibility path=/org/a11y/atspi/accessible/root
+       interface=org.a11y.atspi.Socket
+       member=Embed
+       peer=(name=org.a11y.atspi.Registry),
+
+  dbus (receive) bus=accessibility path=/org/a11y/atspi/accessible/root
+       interface=org.freedesktop.DBus.Properties
+       member=Set
+       peer=(name=:*),
+
+  dbus (send) bus=accessibility path=/org/a11y/atspi/registry
+       interface=org.a11y.atspi.Registry
+       member=GetRegisteredEvents
+       peer=(name=org.a11y.atspi.Registry),
+
+  dbus (receive) bus=accessibility path=/org/a11y/atspi/registry
+       interface=org.a11y.atspi.Registry
+       member=EventListenerDeregistered
+       peer=(name=:*),
+
+  dbus (send) bus=accessibility path=/org/a11y/atspi/registry/deviceeventcontroller
+       interface=org.a11y.atspi.DeviceEventController
+       member={GetKeystrokeListeners,GetDeviceEventListeners}
+       peer=(name=org.a11y.atspi.Registry),
+
+  dbus (bind) bus=session
+       name=org.kde.StatusNotifierItem-*,
+
+  dbus (bind) bus=session
+       name=org.mpris.MediaPlayer2.vlc{,.instance*},
+
   @{exec_path} mrix,
 
   # Which media files VLC should be able to open
@@ -94,9 +215,6 @@ profile vlc @{exec_path} {
   owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=**/ r,
   owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=**.@{vlc_ext} r,
 
-  /var/lib/dbus/machine-id r,
-  /etc/machine-id r,
-
   # VLC files
   /usr/share/vlc/{,**} r,
 
@@ -104,7 +222,7 @@ profile vlc @{exec_path} {
   owner @{HOME}/ r,
   owner @{user_config_dirs}/vlc/ rw,
   owner @{user_config_dirs}/vlc/* rwkl -> @{user_config_dirs}/vlc/#[0-9]*[0-9],
-  owner @{user_share_dirs}/vlc/{,*} rw,
+  owner @{user_share_dirs}/vlc/{,**} rw,
 
   owner @{user_cache_dirs}/ rw,
   owner @{user_cache_dirs}/vlc/{,**} rw,
@@ -114,12 +232,15 @@ profile vlc @{exec_path} {
   owner @{user_config_dirs}/qt5ct/{,**} r,
   /usr/share/qt5ct/** r,
 
+  /dev/snd/ r,
   /dev/shm/#[0-9]*[0-9] rw,
 
   deny owner @{PROC}/@{pid}/cmdline r,
        owner @{PROC}/@{pid}/mountinfo r,
        owner @{PROC}/@{pid}/mounts r,
-             @{PROC}/@{pid}/net/if_inet6 r,
+       owner @{PROC}/@{pid}/comm r,
+       owner @{PROC}/@{pid}/task/@{tid}/comm rw,
+             @{PROC}/@{pids}/net/if_inet6 r,
   deny       @{PROC}/sys/kernel/random/boot_id r,
 
   # Udev enumeration
@@ -147,7 +268,6 @@ profile vlc @{exec_path} {
   owner /dev/tty[0-9]* rw,
   owner @{HOME}/.anyRemote/anyremote.stdout w,
 
-
   profile xdg-screensaver {
     include <abstractions/base>
     include <abstractions/consoles>
@@ -169,6 +289,8 @@ profile vlc @{exec_path} {
     /dev/dri/card[0-9]* rw,
     network inet stream,
     network inet6 stream,
+
+    include if exists <local/vlc_xdg-screensaver>
   }
 
   include if exists <local/vlc>

apparmor.d/groups/freedesktop/polkit-agent-helper

@@ -29,13 +29,15 @@ profile polkit-agent-helper @{exec_path} {
   signal (receive) set=(term, kill) peer=gnome-shell,
   signal (receive) set=(term, kill) peer=pkexec,
 
-  dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
+  dbus (send) bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
        interface=org.freedesktop.DBus.Properties
-       member=GetAll,
+       member=GetAll
+       peer=(name=:*),
 
-  dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
+  dbus (send) bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
        interface=org.freedesktop.PolicyKit[0-9].Authority
-       member=AuthenticationAgentResponse2,
+       member=AuthenticationAgentResponse2
+       peer=(name=:*),
 
   @{exec_path} mr,
 

apparmor.d/groups/freedesktop/polkitd

@@ -23,13 +23,14 @@ profile polkitd @{exec_path} {
   ptrace (read),
 
   dbus (send,receive) bus=system path=/org/freedesktop/PolicyKit[0-9]/*
-       interface=org.freedesktop.{DBus.Introspectable,DBus.Properties,PolicyKit[0-9].*},
+       interface=org.freedesktop.{DBus.Introspectable,DBus.Properties,PolicyKit[0-9].*}, # all members
 
-  dbus send bus=system path=/org/freedesktop/DBus
+  dbus (send) bus=system path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID,RequestName},
+       member={GetConnectionUnixProcessID,GetConnectionUnixUser,RequestName}
+       peer=(name=org.freedesktop.DBus),
 
-  dbus bind bus=system 
+  dbus (bind) bus=system
        name=org.freedesktop.PolicyKit[0-9],
 
   @{exec_path} mr,

apparmor.d/profiles-m-r/pkexec

@@ -29,19 +29,32 @@ profile pkexec @{exec_path} flags=(complain) {
 
   network netlink raw,
 
-  dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
+  dbus (send) bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
        interface=org.freedesktop.DBus.Properties
-       member=GetAll,
+       member=GetAll
+       peer=(name=:*),
 
-  dbus send bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
+  dbus (send) bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
        interface=org.freedesktop.PolicyKit[0-9].Authority
-       member={EnumerateActions,CheckAuthorization},
+       member={EnumerateActions,CheckAuthorization,RegisterAuthenticationAgent,UnregisterAuthenticationAgent}
+       peer=(name=:*),
+
+  dbus (receive) bus=system path=/org/freedesktop/PolicyKit[0-9]*/Authority
+       interface=org.freedesktop.PolicyKit[0-9]*.Authority
+       member=Changed
+       peer=(name=:*),
+
+  dbus (receive) bus=system path=/org/freedesktop/PolicyKit[0-9]*/AuthenticationAgent
+       interface=org.freedesktop.PolicyKit[0-9]*.AuthenticationAgent
+       member=BeginAuthentication
+       peer=(name=:*),
 
   @{exec_path} mr,
 
   # Apps to be run via pkexec
   /{usr/,}{s,}bin/*            rPUx,
   /{usr/,}lib/gvfs/gvfsd-admin rPUx, #(#FIXME#)
+  /{usr/,}lib/polkit-agent-helper-[0-9]              rPx,
   /{usr/,}lib/polkit-[0-9]/polkit-agent-helper-[0-9] rPx,
   /{usr/,}lib/update-notifier/package-system-locked  rPx,
   /usr/share/apport/apport-gtk rPx,