feat(profiles): general update.

apparmor.d/profiles-s-z/spice-vdagent

@@ -49,8 +49,12 @@ profile spice-vdagent @{exec_path} {
 
   @{exec_path} mr,
 
+  /usr/share/pipewire/client-rt.conf r,
+
   /etc/pipewire/client.conf r,
 
+  /var/lib/nscd/passwd r,
+
   owner @{user_config_dirs}/user-dirs.dirs r,
 
   @{run}/spice-vdagentd/spice-vdagent-sock rw,

apparmor.d/profiles-s-z/update-ca-certificates

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2020-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -19,16 +20,17 @@ profile update-ca-certificates @{exec_path} {
   /{usr/,}bin/basename   rix,
   /{usr/,}bin/cat        rix,
   /{usr/,}bin/chmod      rix,
+  /{usr/,}bin/find       rix,
+  /{usr/,}bin/flock      rix,
+  /{usr/,}bin/ln         rix,
   /{usr/,}bin/mktemp     rix,
   /{usr/,}bin/mv         rix,
   /{usr/,}bin/readlink   rix,
   /{usr/,}bin/rm         rix,
   /{usr/,}bin/sed        rix,
   /{usr/,}bin/sort       rix,
-  /{usr/,}bin/wc         rix,
-  /{usr/,}bin/find       rix,
-  /{usr/,}bin/ln         rix,
   /{usr/,}bin/test       rix,
+  /{usr/,}bin/wc         rix,
 
   /{usr/,}bin/openssl    rix,
 

apparmor.d/profiles-s-z/update-command-not-found

@@ -16,6 +16,8 @@ profile update-command-not-found @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/python>
 
+  capability dac_read_search,
+
   @{exec_path} r,
 
   /{usr/,}bin/python3.[0-9]* r,

apparmor.d/profiles-s-z/virt-manager

@@ -48,6 +48,9 @@ profile virt-manager @{exec_path} flags=(attach_disconnected) {
   /{usr/,}bin/ssh                               rPx,
   /{usr/,}lib/spice-client-glib-usb-acl-helper  rPx,
 
+  /{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop rPx -> child-open,
+  /{usr/,}lib/gio-launch-desktop                          rPx -> child-open,
+
   /usr/share/egl/{,**} r,
   /usr/share/gtksourceview-4/{,**} r,
   /usr/share/hwdata/*.ids r,