felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles) add initial support for ubuntu 22.04

Browse source
This commit is contained in:
Alexandre Pujol 2022-05-21 16:49:45 +01:00
parent 3ac7d41bf5
commit 0dbe0d2790
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
33 changed files with 253 additions and 121 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/gnome/evolution-alarm-notify
View file

@ -20,6 +20,8 @@ profile evolution-alarm-notify @{exec_path} {
/usr/share/evolution-data-server/{,**} r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/ubuntu/applications/ r,
/usr/share/zoneinfo-icu/{,**} r,
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,

16
apparmor.d/groups/gnome/gdm-session-worker
View file

@ -41,13 +41,14 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
@{exec_path} mrix,
/{usr/,}bin/gnome-keyring-daemon rPx,
@{libexec}/gdm-wayland-session rPx,
@{libexec}/gdm-x-session rPx,
/etc/gdm/{Pre,Post}Session/Default rix,
/{usr/,}bin/gnome-keyring-daemon rPx,
@{libexec}/gdm-wayland-session rPx,
@{libexec}/gdm-x-session rPx,
/etc/gdm{3,}/{Pre,Post}Session/Default rix,
/etc/default/locale r,
/etc/environment r,
/etc/gdm/custom.conf r,
/etc/gdm{3,}/custom.conf r,
/etc/locale.conf r,
/etc/machine-id r,
/etc/motd r,
@ -64,9 +65,14 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
@{run}/systemd/users/@{uid} r,
@{run}/utmp rwk,
@{run}/systemd/userdb/io.systemd.DynamicUser w,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/loginuid rw,
owner @{PROC}/@{pid}/task/@{tid}/attr/exec rw,
owner @{PROC}/@{pid}/uid_map r,
@{PROC}/1/limits r,
@{PROC}/keys r,
/dev/tty rw,
/dev/tty[0-9]* rw,

17
apparmor.d/groups/gnome/gdm-wayland-session
View file

@ -22,27 +22,38 @@ profile gdm-wayland-session @{exec_path} {
@{exec_path} mr,
# It can run hooks, how to handle them nicely? rCx? them mostly include if exist
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/env rix,
/{usr/,}bin/gnome-session rix,
/{usr/,}bin/grep rix,
/{usr/,}bin/gsettings rix,
/{usr/,}bin/locale rix,
/{usr/,}bin/locale-check rix,
/{usr/,}bin/sed rix,
/{usr/,}bin/tty rix,
/{usr/,}bin/gettext rix,
/{usr/,}bin/zsh rix,
/{usr/,}bin/dbus-daemon rPx,
/{usr/,}bin/dbus-run-session rPx,
/{usr/,}bin/dpkg-query rpx,
/{usr/,}bin/flatpak rPUx,
@{libexec}/gnome-session-binary rPx,
/etc/gdm/custom.conf r,
/usr/share/im-config/{,**} r,
/etc/default/im-config r,
/etc/gdm{3,}/custom.conf r,
/etc/machine-id r,
/etc/shells r,
/etc/X11/Xsession.d/*im-config_launch r,
/usr/share/gdm/gdm.schemas r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
@{run}/gdm/custom.conf r,
owner @{run}/user/@{uid}/bus rw,
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
@{run}/gdm/custom.conf r,

26
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -33,6 +33,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/mkdir rix,
/{usr/,}bin/touch rix,
/{usr/,}bin/gsettings rix,
/{usr/,}bin/session-migration rix,
/{usr/,}bin/xdg-user-dirs-gtk-update rix,
@{libexec}/gnome-session-check-accelerated rix,
@{libexec}/gnome-session-check-accelerated-gl-helper rix,
@ -42,16 +43,21 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/aa-notify rPx,
/{usr/,}bin/blueman-applet rPx,
/{usr/,}bin/xdg-user-dirs-update rPx,
/{usr/,}bin/firewall-applet rPUx,
/{usr/,}bin/gnome-keyring-daemon rPx,
/{usr/,}bin/gnome-shell rPx,
/{usr/,}bin/im-launch rPx,
/{usr/,}bin/pkcs11-register rPx,
/{usr/,}bin/snap rPUx,
/{usr/,}bin/start-pulseaudio-x11 rPx,
/{usr/,}bin/xbrlapi rPx,
@{libexec}/at-spi-bus-launcher rPx,
@{libexec}/evolution-data-server/evolution-alarm-notify rPx,
@{libexec}/gsd-* rPx,
/usr/share/applications//{,**} r,
/usr/share/applications/{,**} r,
/usr/share/dconf/profile/gdm r,
/usr/share/gdm/greeter-dconf-defaults r,
/usr/share/gdm/greeter/applications/{,**} r,
/usr/share/gdm/greeter/autostart/{,*.desktop} r,
@ -59,19 +65,23 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
/usr/share/glvnd/egl_vendor.d/ r,
/usr/share/gnome-session/hardware-compatibility r,
/usr/share/gnome-session/sessions/*.session r,
/usr/share/gnome/autostart/{,*.desktop} r,
/usr/share/icons/{,**} r,
/usr/share/dconf/profile/gdm r,
/usr/share/mime/mime.cache r,
/usr/share/ubuntu/applications/{,*.desktop} r,
/usr/share/X11/xkb/{,**} r,
/etc/gnome/defaults.list r,
/etc/xdg/autostart/{,*.desktop} r,
/var/lib/gdm/.config/dconf/user r,
/var/lib/gdm/.cache/mesa_shader_cache/index rw,
/var/lib/gdm/.config/gnome-session/ rw,
/var/lib/gdm/.config/gnome-session/saved-session/ rw,
/var/lib/gdm/.local/share/applications/{,**} r,
/var/lib/gdm{3,}/.cache/mesa_shader_cache/index rw,
/var/lib/gdm{3,}/.config/dconf/user r,
/var/lib/gdm{3,}/.config/gnome-session/ rw,
/var/lib/gdm{3,}/.config/gnome-session/saved-session/ rw,
/var/lib/gdm{3,}/.local/share/applications/{,**} r,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
/var/lib/snapd/desktop/applications/{,mimeinfo.cache} r,
/var/lib/flatpak/exports/share/applications/{,**} r,
owner @{user_config_dirs}/autostart/{,*.desktop} r,
@ -83,6 +93,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/user-dirs.dirs r,
owner @{user_config_dirs}/user-dirs.locale r,
owner @{user_share_dirs}/applications/ r,
owner @{user_share_dirs}/applications/mimeinfo.cache r,
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
@ -108,5 +119,6 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
/dev/tty rw,
/dev/tty[0-9]* rw,
include if exists <usr/gnome-session-binary.d>
include if exists <local/gnome-session-binary>
}

2
apparmor.d/groups/gnome/gnome-session-ctl
View file

@ -12,7 +12,9 @@ profile gnome-session-ctl @{exec_path} {
@{exec_path} mr,
owner @{run}/user/@{uid}/bus rw,
owner @{run}/user/@{uid}/gnome-session-leader-fifo r,
@{run}/user/@{uid}/systemd/notify rw,
include if exists <local/gnome-session-ctl>
}

52
apparmor.d/groups/gnome/gnome-shell
View file

@ -44,6 +44,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
@{libexec}/polkit-1/polkit* rPx,
@{libexec}/* rPUx,
/opt/*/**/*.png r,
/usr/share/backgrounds/{,**} r,
/usr/share/dconf/profile/gdm r,
/usr/share/desktop-directories/{,*.directory} r,
@ -57,29 +58,40 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
/usr/share/libinput/ r,
/usr/share/libinput/[0-9][0-9]-*.quirks r,
/usr/share/libwacom/{,*.stylus,*.tablet} r,
/usr/share/plymouth/*.png r,
/usr/share/ubuntu/applications/{,*.desktop} r,
/usr/share/wayland-sessions/{,*.desktop} r,
/usr/share/xml/iso-codes/iso_[0-9]*-[0-9]*.xml r,
/usr/share/xsessions/{,*.desktop} r,
/opt/*/**/*.png r,
/.flatpak-info r,
/etc/fstab r,
/etc/machine-id r,
/etc/xdg/menus/gnome-applications.menu r,
/var/lib/dbus/machine-id r,
/var/lib/gdm/.config/dconf/user r,
/var/lib/gdm/.config/ibus/ rw,
/var/lib/gdm/.config/ibus/bus/ rw,
/var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-{,wayland-}[0-9] r,
/var/lib/gdm/.config/pulse/ r,
/var/lib/gdm/.config/pulse/client.conf r,
/var/lib/gdm/.config/pulse/cookie rwk,
/var/lib/gdm/.local/share/applications/{,**} r,
/var/lib/gdm/.local/share/gnome-shell/ rw,
/var/lib/gdm{3,}/.cache/ w,
/var/lib/gdm{3,}/.cache/mesa_shader_cache/ rw,
/var/lib/gdm{3,}/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/ rw,
/var/lib/gdm{3,}/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/[0-9a-f]* rw,
/var/lib/gdm{3,}/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/[0-9a-f]*.tmp rwk,
/var/lib/gdm{3,}/.cache/mesa_shader_cache/index rw,
/var/lib/gdm{3,}/.config/dconf/user r,
/var/lib/gdm{3,}/.config/ibus/ rw,
/var/lib/gdm{3,}/.config/ibus/bus/ rw,
/var/lib/gdm{3,}/.config/ibus/bus/[0-9a-f]*-unix-{,wayland-}[0-9] r,
/var/lib/gdm{3,}/.config/pulse/ r,
/var/lib/gdm{3,}/.config/pulse/client.conf r,
/var/lib/gdm{3,}/.config/pulse/cookie rwk,
/var/lib/gdm{3,}/.local/share/applications/{,**} r,
/var/lib/gdm{3,}/.local/share/gnome-shell/ rw,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
/var/lib/flatpak/app/**/gnome-shell/{,**} r,
/var/lib/flatpak/exports/share/gnome-shell/{,**} r,
/var/lib/snapd/desktop/icons/{,**} r,
owner @{HOME}/.mozilla/firefox/firefox-mpris/{,*} r,
owner @{HOME}/@{XDG_MUSIC_DIR}/**/*.jpg r,
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
@ -91,6 +103,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/monitors.xml{,~} rwl,
owner @{user_share_dirs}/backgrounds/{,**} rw,
owner @{user_share_dirs}/desktop-directories/{,**} r,
owner @{user_share_dirs}/gnome-shell/{,**} rw,
owner @{user_share_dirs}/gnome-shell/extensions/{,**} r,
owner @{user_share_dirs}/gvfs-metadata/{,*} r,
@ -103,13 +116,14 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
owner @{user_cache_dirs}/media-art/{,**} r,
owner @{user_cache_dirs}/vlc/**/*.jpg r,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw,
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
owner @{run}/user/@{uid}/gdm/Xauthority r,
owner @{run}/user/@{uid}/gnome-shell-disable-extensions rw,
owner @{run}/user/@{uid}/gnome-shell/{,**} rw,
owner @{run}/user/@{uid}/gvfsd/socket-[0-9A-Za-z]* rw,
owner @{run}/user/@{uid}/wayland-[0-9].lock rwk,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw,
owner /dev/shm/.org.chromium.Chromium.* rw,
owner /dev/shm/wayland.mozilla.ipc.[0-9]* rw,
@ -144,30 +158,34 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
@{sys}/bus/ r,
@{sys}/class/ r,
@{sys}/class/net/ r,
@{sys}/class/input/ r,
@{sys}/class/hwmon/ r,
@{sys}/class/input/ r,
@{sys}/class/net/ r,
@{sys}/class/power_supply/ r,
@{sys}/**/uevent r,
@{sys}/devices/virtual/net/*/statistics/{rx_bytes,tx_bytes} r,
@{sys}/devices/**/power_supply/**/{type,online} r,
@{sys}/devices/**/hwmon/{,name,temp*,fan*} r,
@{sys}/devices/**/hwmon/**/{,name,temp*,fan*} r,
@{sys}/devices/**/hwmon[0-9]*/{,name,temp*,fan*} r,
@{sys}/devices/**/hwmon[0-9]*/**/{,name,temp*,fan*} r,
@{sys}/devices/**/hwmon/{,name,temp*,fan*} r,
@{sys}/devices/**/hwmon/**/{,name,temp*,fan*} r,
@{sys}/devices/**/power_supply/**/{type,online} r,
@{sys}/devices/pci[0-9]*/**/boot_vga r,
@{sys}/devices/pci[0-9]*/**/drm/ r,
@{sys}/devices/pci[0-9]*/**/input[0-9]*/{properties,name} r,
@{sys}/devices/pci[0-9]*/**/net/*/statistics/{rx_bytes,tx_bytes} r,
@{sys}/devices/virtual/net/*/statistics/{rx_bytes,tx_bytes} r,
owner @{PROC}/@{pid}/comm r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/task/@{pid}/cmdline r,
@{PROC}/ r,
@{PROC}/@{pid}/attr/current r,
@{PROC}/@{pid}/cgroup r,
@{PROC}/@{pid}/net/* r,
@{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/task/@{tid}/stat r,
@{PROC}/@{pids}/cmdline r,
@{PROC}/1/cgroup r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,

1
apparmor.d/groups/gnome/gnome-shell-calendar-server
View file

@ -15,6 +15,7 @@ profile gnome-shell-calendar-server @{exec_path} {
@{exec_path} mr,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/zoneinfo-icu/{,**} r,
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,

1
apparmor.d/groups/gnome/gnome-system-monitor
View file

@ -37,6 +37,7 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
owner @{run}/user/@{uid}/doc/ rw,
@{run}/systemd/sessions/[0-9]*{,.ref} r,

4
apparmor.d/groups/gnome/gnome-terminal-server
View file

@ -26,12 +26,16 @@ profile gnome-terminal-server @{exec_path} {
/usr/share/X11/xkb/{,**} r,
/var/lib/flatpak/exports/share/icons/{,**} r,
/var/lib/snapd/desktop/icons/{,**} r,
/etc/shells r,
owner @{run}/user/@{uid}/at-spi/bus rw,
owner @{run}/user/@{uid}/bus rw,
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
owner @{run}/user/@{uid}/gdm/Xauthority r,
owner @{run}/user/@{uid}/wayland-[0-9]* rw,
owner /tmp/#[0-9]* rw,

7
apparmor.d/groups/gnome/gsd-color
View file

@ -26,9 +26,10 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
/usr/share/X11/xkb/** r,
/var/lib/flatpak/exports/share/mime/mime.cache r,
/var/lib/gdm/.config/dconf/user r,
/var/lib/gdm/.local/share/icc/ rw,
/var/lib/gdm/.local/share/icc/edid-*.icc rw,
/var/lib/gdm{3,}/.config/dconf/user r,
/var/lib/gdm{3,}/.local/share/icc/ rw,
/var/lib/gdm{3,}/.local/share/icc/edid-*.icc rw,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
owner @{user_share_dirs}/icc/ r,
owner @{user_share_dirs}/icc/edid-*.icc rw,

3
apparmor.d/groups/gnome/gsd-datetime
View file

@ -22,7 +22,8 @@ profile gsd-datetime @{exec_path} flags=(attach_disconnected) {
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
/var/lib/gdm/.config/dconf/user r,
/var/lib/gdm{3,}/.config/dconf/user r,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
owner /dev/tty[0-9]* rw,

4
apparmor.d/groups/gnome/gsd-keyboard
View file

@ -24,8 +24,8 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
/usr/share/icons/{,**} r,
/usr/share/X11/xkb/** r,
/var/lib/gdm/.config/dconf/user r,
/var/lib/gdm/.config/.gsd-keyboard.settings-ported* rw,
/var/lib/gdm{3,}/.config/dconf/user r,
/var/lib/gdm{3,}/.config/.gsd-keyboard.settings-ported* rw,
owner @{user_config_dirs}/.gsd-keyboard.settings-ported* rw,
owner @{user_share_dirs}/gnome-settings-daemon/ rw,

2
apparmor.d/groups/gnome/gsd-smartcard
View file

@ -10,6 +10,7 @@ include <tunables/global>
profile gsd-smartcard @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dconf>
include <abstractions/p11-kit>
signal (receive) set=(term, hup) peer=gdm*,
@ -23,6 +24,7 @@ profile gsd-smartcard @{exec_path} flags=(attach_disconnected) {
owner @{run}/user/@{uid}/dconf/user rw,
/var/lib/gdm/.config/dconf/user r,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
owner /dev/tty[0-9]* rw,

5
apparmor.d/groups/gnome/gsd-sound
View file

@ -22,8 +22,9 @@ profile gsd-sound @{exec_path} flags=(attach_disconnected) {
/etc/machine-id r,
/var/lib/gdm/.local/share/sounds/ rw,
/var/lib/gdm/.config/dconf/user r,
/var/lib/gdm{3,}/.local/share/sounds/ rw,
/var/lib/gdm{3,}/.config/dconf/user r,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
owner @{user_share_dirs}/sounds/ rw,

18
apparmor.d/groups/gnome/gsd-xsettings
View file

@ -26,15 +26,21 @@ profile gsd-xsettings @{exec_path} {
@{exec_path} mr,
/{usr/,}bin/cat rix,
/{usr/,}bin/which{,.debianutils} rix,
/{usr/,}bin/run-parts rCx -> run-parts,
/{usr/,}bin/busctl rPx,
/{usr/,}bin/pactl rPx,
/{usr/,}bin/xrdb rPx,
/{usr/,}lib/ibus/ibus-x11 rPx,
@{libexec}/ibus-x11 rPx,
/usr/share/dconf/profile/gdm r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/gdm/greeter-dconf-defaults r,
/etc/X11/Xsession.options r,
/etc/xdg/Xwayland-session.d/ r,
/etc/xdg/Xwayland-session.d/* rix,
@ -47,10 +53,22 @@ profile gsd-xsettings @{exec_path} {
owner @{run}/user/@{uid}/gdm/Xauthority r,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[a-zA-z0-9]* r,
owner @{run}/systemd/users/@{uid}/ r,
@{run}/systemd/sessions/[0-9]* r,
owner @{PROC}/@{pid}/fd/ r,
/dev/tty rw,
/dev/tty[0-9]* rw,
profile run-parts {
include <abstractions/base>
/{usr/,}bin/run-parts mr,
/etc/X11/Xresources/ r,
}
include if exists <local/gsd-xsettings>
}

8
apparmor.d/groups/gnome/tracker-extract
View file

@ -22,17 +22,22 @@ profile tracker-extract @{exec_path} {
@{exec_path} mr,
/usr/share/applications/*.desktop r,
/usr/share/dconf/profile/gdm r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/hwdata/*.ids r,
/usr/share/ladspa/rdf/{,**} r,
/usr/share/mime/mime.cache r,
/usr/share/osinfo/{,**} r,
/usr/share/poppler/{,**} r,
/usr/share/tracker3-miners/{,**} r,
/usr/share/tracker3/{,**} r,
/usr/share/hwdata/*.ids r,
/etc/libva.conf r,
/var/lib/gdm{3,}/.cache/ rw,
/var/lib/gdm{3,}/.cache/tracker3/{,**} rw,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
# Allow to search user files
owner @{HOME}/{,**} r,
owner @{MOUNTS}/*/{,**} r,
@ -42,6 +47,7 @@ profile tracker-extract @{exec_path} {
owner @{user_cache_dirs}/tracker3/files/{,**} rwk,
owner @{user_share_dirs}/gvfs-metadata/** r,
owner @{run}/user/@{uid}/bus rw,
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
@{run}/blkid/blkid.tab r,

19
apparmor.d/groups/gnome/tracker-miner
View file

@ -9,20 +9,33 @@ include <tunables/global>
@{exec_path} = @{libexec}/tracker-miner-fs-{,control-}3
profile tracker-miner @{exec_path} {
include <abstractions/base>
include <abstractions/dbus-session-strict> # TODO: FIXME: See if we keep them like this.
include <abstractions/dconf>
include <abstractions/disks-read>
include <abstractions/nameservice-strict>
include <abstractions/private-files-strict>
include <abstractions/private-files>
@{exec_path} mr,
/usr/share/tracker3/{,**} r,
/usr/share/tracker3-miners/{,**} r,
/usr/share/applications/{,mimeinfo.cache,*.list} r,
/usr/share/dconf/profile/gdm r,
/usr/share/gdm/greeter/applications/{,mimeinfo.cache,*.list} r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/applications/{,mimeinfo.cache} r,
/usr/share/mime/mime.cache r,
/usr/share/tracker3-miners/{,**} r,
/usr/share/tracker3/{,**} r,
/usr/share/ubuntu/applications/ r,
/etc/fstab r,
/var/lib/flatpak/exports/share/applications/{,mimeinfo.cache} r,
/var/lib/snapd/desktop/applications/{,mimeinfo.cache} r,
/var/lib/gdm{3,}/ r,
/var/lib/gdm{3,}/.cache/tracker3/tracker3/files/{,**} rwk,
/var/lib/gdm{3,}/greeter-dconf-defaults r,
owner /var/tmp/etilqs_[0-9a-f]* rw,
# Allow to search user files