Merge branch 'xfce' of github.com:nobody43/apparmor.d into nobody43-xfce

* 'xfce' of github.com:nobody43/apparmor.d:
  xfce, fixes
  Adapt to RO root
  xfce, flags
  xfce, proper abi
  xfce, new profiles
  xfce, updates

apparmor.d/profiles-s-z/system-config-printer-applet

@@ -10,6 +10,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/system-config-printer-applet /usr/share/system-config-printer/applet.py
 profile system-config-printer-applet @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-session>
   include <abstractions/python>
   include <abstractions/nameservice-strict>
 

apparmor.d/profiles-s-z/ucf

@@ -0,0 +1,61 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2019-2022 Mikhail Morfikov
+# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{bin}/ucf
+profile ucf @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+  include <abstractions/perl>
+
+  @{exec_path} r,
+  @{sh_path}            rix,
+
+  @{bin}/{,e}grep       rix,
+  @{bin}/basename       rix,
+  @{bin}/cat            rix,
+  @{bin}/cp             rix,
+  @{bin}/dirname        rix,
+  @{bin}/{m,g,}awk      rix,
+  @{bin}/getopt         rix,
+  @{bin}/id             rix,
+  @{bin}/md5sum         rix,
+  @{bin}/mkdir          rix,
+  @{bin}/mv             rix,
+  @{bin}/readlink       rix,
+  @{bin}/rm             rix,
+  @{bin}/sed            rix,
+  @{bin}/seq            rix,
+  @{bin}/stat           rix,
+  @{bin}/tr             rix,
+  @{bin}/which{,.debianutils} rix,
+
+  @{bin}/dpkg-query     rpx,
+  @{bin}/dpkg-divert    rPx,
+  @{pager_path}         rCx -> child-pager,
+
+  /usr/share/debconf/frontend     rPx, # TODO: rCx -> debonc-frontend,
+
+  /usr/share/** r,
+
+  /etc/default/* rw,
+  /etc/libreoffice/registry/** r,
+  /etc/ucf.conf r,
+
+  /var/lib/ucf/** rw,
+
+  # For shell pwd
+  / r,
+  /root/ r,
+
+  owner /tmp/tmp.@{rand10} r,
+
+  include if exists <local/ucf>
+}
+
+# vim:syntax=apparmor