feat: profile update.

apparmor.d/groups/bus/ibus-dconf

@@ -31,7 +31,7 @@ profile ibus-dconf @{exec_path} flags=(attach_disconnected) {
   owner @{run}/user/@{uid}/dconf/ rw,
   owner @{run}/user/@{uid}/dconf/user rw,
   /var/lib/gdm/.cache/dconf/ w,
-  /var/lib/gdm/.config/dconf/user r,
+  /var/lib/gdm/.config/dconf/user rw,
 
   owner /dev/tty[0-9]* rw,
 

apparmor.d/groups/gnome/gdm-runtime-config

@@ -0,0 +1,19 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}lib/gdm-runtime-config
+profile gdm-runtime-config @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  @{run}/gdm/ r,
+  @{run}/gdm/custom.conf* rw,
+
+  include if exists <local/gdm-runtime-config>
+}

apparmor.d/groups/gnome/gnome-control-center

@@ -28,12 +28,14 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
   network netlink raw,
 
   signal (send) set=(kill) peer=unconfined,
+  signal (send) set=(kill) peer=passwd,
 
   @{exec_path} mr,
   /{usr/,}bin/bwrap      rPUx,
   /{usr/,}bin/gcm-viewer rix,
   /{usr/,}bin/locale     rix,
   /{usr/,}bin/openvpn    rPx,
+  /{usr/,}bin/passwd     rPx,
   /{usr/,}lib/gnome-control-center-print-renderer     rPx,
   /{usr/,}lib/webkit2gtk-{3,4}.0/WebKitNetworkProcess rix,
 

apparmor.d/groups/gnome/gnome-session-binary

@@ -99,6 +99,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
         @{run}/systemd/users/@{uid} r,
 
   @{sys}/devices/**/{vendor,device} r,
+  @{sys}/devices/pci[0-9]*/**/revision r,
 
   owner @{PROC}/@{pid}/loginuid r,
   owner @{PROC}/@{pid}/cmdline r,

apparmor.d/groups/gvfs/gvfsd-mtp

@@ -1,6 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2021 Mikhail Morfikov
-#               2021 Alexandre Pujol <alexandre@pujol.io>
+# Copyright (C) 2021-2022 Mikhail Morfikov
+# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -11,6 +11,7 @@ include <tunables/global>
 @{exec_path} += @{libexec}/gvfsd-mtp
 profile gvfsd-mtp @{exec_path} {
   include <abstractions/base>
+  include <abstractions/dconf>
   include <abstractions/devices-usb>
   include <abstractions/freedesktop.org>
   include <abstractions/private-files-strict>
@@ -20,16 +21,14 @@ profile gvfsd-mtp @{exec_path} {
 
   @{exec_path} mr,
 
+  /usr/share/glib-2.0/schemas/gschemas.compiled r,
+
   owner @{HOME}/{,**} rw,
   owner @{MOUNTS}/*/{,**} rw,
 
-  owner @{run}/user/@{uid}/gvfsd/socket-* rw,
-
-  include <abstractions/dconf>
   owner @{run}/user/@{uid}/dconf/ rw,
   owner @{run}/user/@{uid}/dconf/user rw,
-
-  /usr/share/glib-2.0/schemas/gschemas.compiled r,
+  owner @{run}/user/@{uid}/gvfsd/socket-* rw,
 
   include if exists <local/gvfsd-mtp>
 }