diff --git a/apparmor.d/groups/freedesktop/xdg-mime b/apparmor.d/groups/freedesktop/xdg-mime index e2486f9fd..650d1f554 100644 --- a/apparmor.d/groups/freedesktop/xdg-mime +++ b/apparmor.d/groups/freedesktop/xdg-mime @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/xdg-mime profile xdg-mime @{exec_path} flags=(attach_disconnected) { include + include include @{exec_path} r, @@ -50,14 +51,22 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) { @{bin}/vendor_perl/mimetype Px, @{bin}/xprop Px, + owner @{user_config_dirs}/mimeapps.list{,.new} rw, + owner @{tmp}/wl-copy-buffer-@{rand6}/stdin r, + @{PROC}/version r, + /dev/tty rw, profile bus flags=(complain) { include include include + include + + @{bin}/dbus-send mr, + include if exists } diff --git a/apparmor.d/groups/freedesktop/xdg-open b/apparmor.d/groups/freedesktop/xdg-open index 8e90bc423..b0b44e388 100644 --- a/apparmor.d/groups/freedesktop/xdg-open +++ b/apparmor.d/groups/freedesktop/xdg-open @@ -20,6 +20,7 @@ profile xdg-open @{exec_path} flags=(attach_disconnected) { @{bin}/basename ix, @{bin}/cat ix, @{bin}/cut ix, + @{bin}/env ix, @{bin}/readlink ix, @{bin}/realpath ix, @{bin}/sed ix, @@ -35,10 +36,15 @@ profile xdg-open @{exec_path} flags=(attach_disconnected) { @{bin}/xdg-mime Px, @{open_path} Px -> child-open-any, - profile bus { + @{PROC}/version r, + + profile bus flags=(attach_disconnected) { include include include + include + + @{bin}/dbus-send mr, include if exists } diff --git a/apparmor.d/groups/freedesktop/xdg-settings b/apparmor.d/groups/freedesktop/xdg-settings index f64b879f6..2525e1462 100644 --- a/apparmor.d/groups/freedesktop/xdg-settings +++ b/apparmor.d/groups/freedesktop/xdg-settings @@ -28,6 +28,7 @@ profile xdg-settings @{exec_path} { @{bin}/realpath rix, @{bin}/rm ix, @{bin}/sed ix, + @{bin}/sleep ix, @{bin}/sort ix, @{bin}/touch ix, @{bin}/tr ix, @@ -46,6 +47,7 @@ profile xdg-settings @{exec_path} { @{bin}/xprop Px, owner @{user_config_dirs}/xfce4/helpers.rc{,.@{rand6}} rw, + owner @{user_share_dirs}/applications/{,**} rw, @{PROC}/version r, @@ -55,6 +57,9 @@ profile xdg-settings @{exec_path} { include include include + include + + @{bin}/dbus-send mr, include if exists } diff --git a/apparmor.d/groups/freedesktop/xprop b/apparmor.d/groups/freedesktop/xprop index 99959fc73..f83afae61 100644 --- a/apparmor.d/groups/freedesktop/xprop +++ b/apparmor.d/groups/freedesktop/xprop @@ -10,6 +10,7 @@ include @{exec_path} = @{bin}/xprop profile xprop @{exec_path} flags=(attach_disconnected) { include + include include include