feat: profile update.

apparmor.d/groups/gnome/gdm-runtime-config

@@ -0,0 +1,19 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}lib/gdm-runtime-config
+profile gdm-runtime-config @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  @{run}/gdm/ r,
+  @{run}/gdm/custom.conf* rw,
+
+  include if exists <local/gdm-runtime-config>
+}

apparmor.d/groups/gnome/gnome-control-center

@@ -28,12 +28,14 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
   network netlink raw,
 
   signal (send) set=(kill) peer=unconfined,
+  signal (send) set=(kill) peer=passwd,
 
   @{exec_path} mr,
   /{usr/,}bin/bwrap      rPUx,
   /{usr/,}bin/gcm-viewer rix,
   /{usr/,}bin/locale     rix,
   /{usr/,}bin/openvpn    rPx,
+  /{usr/,}bin/passwd     rPx,
   /{usr/,}lib/gnome-control-center-print-renderer     rPx,
   /{usr/,}lib/webkit2gtk-{3,4}.0/WebKitNetworkProcess rix,
 

apparmor.d/groups/gnome/gnome-session-binary

@@ -99,6 +99,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
         @{run}/systemd/users/@{uid} r,
 
   @{sys}/devices/**/{vendor,device} r,
+  @{sys}/devices/pci[0-9]*/**/revision r,
 
   owner @{PROC}/@{pid}/loginuid r,
   owner @{PROC}/@{pid}/cmdline r,