Merge branch 'xfce' of github.com:nobody43/apparmor.d into nobody43-xfce

* 'xfce' of github.com:nobody43/apparmor.d:
  xfce, fixes
  Adapt to RO root
  xfce, flags
  xfce, proper abi
  xfce, new profiles
  xfce, updates

apparmor.d/groups/apt/dpkg-preconfigure

@@ -31,6 +31,9 @@ profile dpkg-preconfigure @{exec_path} {
   @{bin}/sort       rix,
   @{bin}/stty       rix,
   @{bin}/tr         rix,
+  @{bin}/head       rix,
+  @{bin}/readlink   rix,
+  @{bin}/realpath   rix,
 
   @{bin}/findmnt              rPx,
   @{bin}/dpkg                 rPx -> child-dpkg,
@@ -39,7 +42,9 @@ profile dpkg-preconfigure @{exec_path} {
   @{lib}/apt/apt-extracttemplates rPx,
 
   /usr/share/debconf/confmodule r,
+  /usr/share/dictionaries-common/{,*} r,
 
+  /etc/cloud/cloud.cfg.d/90_dpkg.cfg r,
   /etc/debconf.conf r,
   /etc/default/grub r,
   /etc/default/mdadm r,
@@ -48,6 +53,7 @@ profile dpkg-preconfigure @{exec_path} {
   /etc/mdadm/mdadm.conf r,
   /etc/shadow r,
   /etc/ssh/sshd_config r,
+  /etc/X11/Xwrapper.config r,
 
   /var/lib/locales/supported.d/{,*} r,
 
@@ -64,6 +70,7 @@ profile dpkg-preconfigure @{exec_path} {
   owner /var/cache/debconf/tmp.ci/*.config.@{rand6} w,
   owner /var/cache/debconf/tmp.ci/*.passwords.@{rand6} w,
   owner /var/cache/debconf/tmp.ci/*.template.@{rand6} w,
+  owner /var/cache/dictionaries-common/flag-wordlist-new w,
   owner /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
 
   @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r,

apparmor.d/groups/bluetooth/blueman

@@ -11,6 +11,7 @@ include <tunables/global>
 profile blueman @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/audio-client>
+  include <abstractions/bus-accessibility>
   include <abstractions/bus-session>
   include <abstractions/dconf-write>
   include <abstractions/desktop>

apparmor.d/groups/bluetooth/blueman-mechanism

@@ -10,6 +10,7 @@ include <tunables/global>
 @{exec_path} = @{lib}/blueman-mechanism @{lib}/blueman/blueman-mechanism
 profile blueman-mechanism @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/bus-system>
   include <abstractions/nameservice-strict>
   include <abstractions/python>
 

apparmor.d/groups/children/child-dpkg-divert

@@ -22,6 +22,7 @@ profile child-dpkg-divert {
   /var/lib/dpkg/arch r,
   /var/lib/dpkg/status r,
   /var/lib/dpkg/updates/ r,
+  /var/lib/dpkg/updates/@{int} r,
   /var/lib/dpkg/triggers/File r,
   /var/lib/dpkg/triggers/Unincorp r,
   /var/lib/dpkg/diversions r,

apparmor.d/groups/display-manager/lightdm

@@ -10,6 +10,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/lightdm
 profile lightdm @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/bus-system>
   include <abstractions/authentication>
   include <abstractions/desktop>
   include <abstractions/fontconfig-cache-read>
@@ -36,8 +37,13 @@ profile lightdm @{exec_path} flags=(attach_disconnected) {
   signal (send) set=(term) peer=xfce-session,
   signal (send) set=(term) peer=xorg,
 
+  #aa:dbus own bus=system name=org.freedesktop.DisplayManager
+
   @{exec_path} mrix,
 
+  @{sh_path}        rix,
+  @{bin}/{,e,f}grep rix,
+  @{bin}/df         rix,
   @{bin}/rm         rix,
 
   @{bin}/lightdm-*-greeter    rPUx,
@@ -45,6 +51,7 @@ profile lightdm @{exec_path} flags=(attach_disconnected) {
   @{bin}/Xorg                  rPx,
   @{bin}/plymouth              rPx,
   @{bin}/gnome-keyring-daemon  rPx,
+  @{bin}/lightdm-session       rPx,
 
   @{lib}/security-misc/*       rPx, #aa:only whonix
   @{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx,
@@ -81,6 +88,7 @@ profile lightdm @{exec_path} flags=(attach_disconnected) {
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/loginuid rw,
   owner @{PROC}/@{pid}/uid_map r,
+  owner @{PROC}/@{pid}/mountinfo r,
 
   /dev/tty@{int} r,
 

apparmor.d/groups/display-manager/lightdm-session

@@ -0,0 +1,23 @@
+# apparmor.d - Full set of apparmor profiles
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{bin}/lightdm-session
+profile lightdm-session @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  @{bin}/im-launch rPx,
+
+  @{sh_path} rix,
+  @{bin}/mktemp rix,
+  @{bin}/expr rix,
+
+  include if exists <local/lightdm-session>
+}
+
+# vim:syntax=apparmor

apparmor.d/groups/filesystem/mount-cifs

@@ -10,10 +10,12 @@ include <tunables/global>
 @{exec_path} = @{bin}/mount.cifs
 profile mount-cifs @{exec_path} flags=(complain) {
   include <abstractions/base>
+  include <abstractions/consoles>
   include <abstractions/nameservice-strict>
 
   capability sys_admin,
   capability setpcap,
+  capability dac_read_search,
 
   network inet dgram,
   network inet stream,

apparmor.d/groups/freedesktop/pkla-admin-identities

@@ -0,0 +1,20 @@
+# apparmor.d - Full set of apparmor profiles
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{bin}/pkla-admin-identities
+profile pkla-admin-identities @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/nameservice-strict>
+
+  @{exec_path} mr,
+
+  /etc/polkit-1/localauthority.conf.d/{,**} r,
+
+  include if exists <local/pkla-admin-identities>
+}
+
+# vim:syntax=apparmor

apparmor.d/groups/freedesktop/polkit-gnome-authentication-agent

@@ -12,11 +12,20 @@ include <tunables/global>
 @{exec_path} += @{lib}/polkit-gnome/polkit-gnome-authentication-agent-1
 profile polkit-gnome-authentication-agent @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-session>
+  include <abstractions/bus-accessibility>
+  include <abstractions/fontconfig-cache-read>
+  include <abstractions/nameservice-strict>
   include <abstractions/dconf-write>
   include <abstractions/gnome-strict>
 
+  signal (send) set=(term) peer=polkit-agent-helper,
+
   @{exec_path} mr,
 
+  @{lib}/polkit-[0-9]/polkit-agent-helper-[0-9] rPx,
+  @{lib}/polkit-agent-helper-[0-9] rPx,
+
   @{PROC}/@{pid}/cgroup r,
 
   include if exists <local/polkit-gnome-authentication-agent>

apparmor.d/groups/gnome/gnome-system-monitor

@@ -36,7 +36,7 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
   @{bin}/tr     rix,
 
   /usr/share/gnome-system-monitor/{,**} r,
-  /usr/share/firefox-esr/browser/chrome/icons/default/*.png r,
+  /usr/share/firefox{,-esr}/browser/chrome/icons/{,**} r,
 
   / r,
 

apparmor.d/groups/grub/grub-mkconfig

@@ -65,6 +65,7 @@ profile grub-mkconfig @{exec_path} flags=(attach_disconnected) {
   @{lib}/grub/grub-sort-version rPx,
   @{lib}/libostree/grub[0-9]-@{int}_ostree rix,
 
+  /usr/share/desktop-base/*/grub/* r,
   /usr/share/grub/{,**} r,
   /usr/share/terminfo/** r,
 

apparmor.d/groups/grub/grub-probe

@@ -27,6 +27,7 @@ profile grub-probe @{exec_path} {
 
   / r,
   /boot/ r,
+  /boot/grub/ r,
   /boot/grub/themes/{,**} r,
 
   @{PROC}/@{pids}/mountinfo r,

apparmor.d/groups/gvfs/gvfsd-computer

@@ -10,6 +10,9 @@ include <tunables/global>
 @{exec_path} = @{lib}/{,gvfs/}gvfsd-computer
 profile gvfsd-computer @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-session>
+
+  #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_@{int}
 
   @{exec_path} mr,
 

apparmor.d/groups/gvfs/gvfsd-wsdd

@@ -9,9 +9,12 @@ include <tunables/global>
 @{exec_path} = @{lib}/{,gvfs/}gvfsd-wsdd
 profile gvfsd-wsdd @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-session>
 
   network netlink raw,
 
+  #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_wsdd
+
   @{exec_path} mr,
 
   @{bin}/env r,

apparmor.d/groups/network/NetworkManager

@@ -104,6 +104,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
   /etc/network/interfaces.d/{,*} r,
   /etc/NetworkManager/{,**} r,
   /etc/NetworkManager/system-connections/{,**} w,
+  @{etc_rw}/netplan/90-NM-@{uuid}.yaml w,
   @{etc_rw}/resolv.conf rw,
   @{etc_rw}/resolv.conf.[0-9A-Z]* rw,
 

apparmor.d/groups/network/wg-quick

@@ -10,6 +10,7 @@ include <tunables/global>
 profile wg-quick @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
+  include <abstractions/nameservice-strict>
 
   capability dac_read_search,
   capability net_admin,

apparmor.d/groups/polkit/polkitd

@@ -26,6 +26,7 @@ profile polkitd @{exec_path} flags=(attach_disconnected) {
   @{exec_path} mr,
 
   @{bin}/pkla-check-authorization rPUx,
+  @{bin}/pkla-admin-identities     rPx,
 
   /etc/machine-id r,
 

apparmor.d/groups/systemd/systemd-hwdb

@@ -16,10 +16,10 @@ profile systemd-hwdb @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   @{exec_path} mr,
 
   @{lib}/udev/#@{int} rwl,
-  @{lib}/udev/.#hwdb.bin@{hex16} wl -> @{lib}/udev/#@{int},
+  @{lib}/udev/.#hwdb.bin{@{hex16},@{rand6}} wl -> @{lib}/udev/#@{int},
   @{lib}/udev/hwdb.bin w,
 
-  /etc/udev/.#hwdb.bin@{hex16} wl ->  /etc/udev/#@{int},
+  /etc/udev/.#hwdb.bin{@{hex16},@{rand6}} wl ->  /etc/udev/#@{int},
   /etc/udev/hwdb.bin w,
   /etc/udev/hwdb.d/{,*} r,
 

apparmor.d/groups/systemd/systemd-udevd

@@ -80,7 +80,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
   /etc/nfs.conf rk,
 
   /etc/udev/{,**} r,
-  /etc/udev/.#hwdb.bin* rw,
+  /etc/udev/.#hwdb.bin{@{hex16},@{rand6}} rw,
   /etc/udev/hwdb.bin rw,
 
   /etc/modprobe.d/ r,

apparmor.d/groups/utils/su

@@ -25,6 +25,8 @@ profile su @{exec_path} {
   @{bin}/nologin       rPx,
 
   @{etc_ro}/default/su r,
+  /etc/default/locale r,
+  /etc/environment r,
 
   @{HOME}/.xauth@{rand6} rw,
 

apparmor.d/groups/xfce/startxfce

@@ -19,6 +19,7 @@ profile startxfce @{exec_path} {
   @{bin}/mkdir  rix,
   @{bin}/id     rix,
 
+  @{bin}/xdg-user-dirs-update                rPx,
   @{bin}/xfce4-session                       rPx,
   @{bin}/xrdb                                rPx,
   @{bin}/systemctl                           rCx -> systemctl,
@@ -27,6 +28,8 @@ profile startxfce @{exec_path} {
   /etc/X11/xinit/xinitrc.d/{,**} r,
   /etc/xdg/xfce4/{,**} r,
 
+  owner @{HOME}/.Xdefaults r,
+
   profile systemctl flags=(attach_disconnected) {
     include <abstractions/base>
     include <abstractions/app/systemctl>
@@ -36,6 +39,7 @@ profile startxfce @{exec_path} {
 
   profile dbus {
     include <abstractions/base>
+    include <abstractions/bus-session>
 
     @{bin}/dbus-update-activation-environment mr,
 

apparmor.d/groups/xfce/thunar

@@ -9,6 +9,8 @@ include <tunables/global>
 @{exec_path} = @{bin}/thunar
 profile thunar @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-accessibility>
+  include <abstractions/bus-session>
   include <abstractions/deny-sensitive-home>
   include <abstractions/fontconfig-cache-read>
   include <abstractions/nameservice-strict>
@@ -17,6 +19,10 @@ profile thunar @{exec_path} {
 
   network netlink raw,
 
+  #aa:dbus own bus=session name=org.xfce.Thunar
+  #aa:dbus own bus=session name=org.xfce.FileManager
+  #aa:dbus own bus=session name=org.freedesktop.FileManager1
+
   @{exec_path} mr,
 
   @{bin}/thunar-volman  rPx,
@@ -30,6 +36,7 @@ profile thunar @{exec_path} {
 
   /etc/fstab r,
   /etc/timezone r,
+  /etc/xdg/{,xdg-xubuntu/}Thunar/{,**} r,
 
   # Full access to user's data
   / r,
@@ -43,6 +50,10 @@ profile thunar @{exec_path} {
   owner @{run}/user/@{uid}/{,**} rw,
   owner @{tmp}/{,**} rw,
 
+  @{run}/mount/utab r,
+
+  owner @{PROC}/@{pid}/mountinfo r,
+
   # Silence non user's data
   deny /boot/{,**} r,
   deny /opt/{,**} r,
@@ -50,8 +61,6 @@ profile thunar @{exec_path} {
   deny /tmp/.* rw,
   deny /tmp/.*/{,**} rw,
 
-  owner @{PROC}/@{pid}/mountinfo r,
-
   profile dbus {
     include <abstractions/base>
     include <abstractions/nameservice-strict>

apparmor.d/groups/xfce/thunar-volman

@@ -9,6 +9,8 @@ include <tunables/global>
 @{exec_path} = @{bin}/thunar-volman
 profile thunar-volman @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-accessibility>
+  include <abstractions/bus-session>
   include <abstractions/nameservice-strict>
   include <abstractions/xfce>
 

apparmor.d/groups/xfce/tumblerd

@@ -9,18 +9,30 @@ include <tunables/global>
 @{exec_path} = @{lib}/{,@{multiarch}/}tumbler-1/tumblerd
 profile tumblerd @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-session>
+  include <abstractions/desktop>
+  include <abstractions/fontconfig-cache-read>
   include <abstractions/gstreamer>
   include <abstractions/nameservice-strict>
   include <abstractions/thumbnails-cache-write>
 
+  #aa:dbus own bus=session name=org.freedesktop.thumbnails.Cache1
+  #aa:dbus own bus=session name=org.freedesktop.thumbnails.Manager1
+  #aa:dbus own bus=session name=org.freedesktop.thumbnails.Thumbnailer1
+
   @{exec_path} mr,
 
+  @{bin}/gdk-pixbuf-thumbnailer rPx,
+
   /usr/share/backgrounds/xfce/{,**} r,
   /usr/share/thumbnailers/{,**} r,
 
   /etc/fstab r,
   /etc/xdg/tumbler/* r,
 
+  owner /tmp/tumbler-@{rand6}.png r,
+  owner /tmp/tumbler-@{rand6}.??? w,
+
   owner @{PROC}/@{pid}/mountinfo r,
 
   /dev/ r,

apparmor.d/groups/xfce/xfce-clipman-settings

@@ -9,8 +9,12 @@ include <tunables/global>
 @{exec_path} = @{bin}/xfce4-clipman-settings
 profile xfce-clipman-settings @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-accessibility>
+  include <abstractions/bus-session>
   include <abstractions/xfce>
 
+  #aa:dbus own bus=session name=org.xfce.clipman.settings
+
   @{exec_path} mr,
 
   @{open_path} rPx -> child-open-help,

apparmor.d/groups/xfce/xfce-notifyd

@@ -10,6 +10,8 @@ include <tunables/global>
 @{exec_path} = @{lib}/{,@{multiarch}/}xfce4/notifyd/xfce4-notifyd
 profile xfce-notifyd @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-accessibility>
+  include <abstractions/bus-session>
   include <abstractions/fontconfig-cache-read>
   include <abstractions/graphics>
   include <abstractions/nameservice-strict>
@@ -22,6 +24,9 @@ profile xfce-notifyd @{exec_path} {
   network inet6 stream,
   network netlink raw,
 
+  #aa:dbus own bus=session name=org.xfce.Notifyd
+  #aa:dbus own bus=session name=org.freedesktop.Notifications
+
   @{exec_path} mr,
 
   owner @{user_cache_dirs}/xfce4/notifyd/ rw,

apparmor.d/groups/xfce/xfce-panel

@@ -9,12 +9,22 @@ include <tunables/global>
 @{exec_path} = @{bin}/xfce4-panel @{lib}/{,@{multiarch}/}xfce4/panel/wrapper-2.0
 profile xfce-panel @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-accessibility>
+  include <abstractions/bus-system>
+  include <abstractions/bus-session>
+  include <abstractions/fontconfig-cache-read>
+  include <abstractions/thumbnails-cache-read>
   include <abstractions/app-launcher-user>
   include <abstractions/audio-client>
   include <abstractions/dconf-write>
   include <abstractions/nameservice-strict>
   include <abstractions/xfce>
 
+  ptrace (read) peer=xfce-terminal,
+
+  #aa:dbus own bus=session name=org.xfce.Panel
+  #aa:dbus own bus=session name=org.kde.StatusNotifierWatcher
+
   @{exec_path} mr,
 
   @{bin}/exo-open                                     rix,
@@ -26,6 +36,7 @@ profile xfce-panel @{exec_path} {
   @{bin}/sudo rCx -> root,
 
   /usr/share/desktop-directories/{,**} r,
+  /usr/share/firefox{,-esr}/browser/chrome/icons/{,**} r,
   /usr/share/livecheck/** r,
   /usr/share/xfce4/{,**} r,
 
@@ -33,15 +44,20 @@ profile xfce-panel @{exec_path} {
   /etc/machine-id r,
   /etc/timezone r,
   /etc/xdg/menus/{,**} r,
-  /etc/xdg/xfce4/{,**} r,
+  /etc/xdg/{,xdg-xubuntu/}xfce4/{,**} r,
 
   owner @{user_cache_dirs}/xfce4/notifyd/icons/ rw,
+  owner @{user_cache_dirs}/xfce4-indicator-plugin.log w,
   owner @{user_config_dirs}/xfce4/panel/{,**} rw,
 
+  owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} w,
+
         @{PROC}/cmdline r,
   owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/mountinfo r,
 
+  deny @{user_share_dirs}/gvfs-metadata/{,*} r,
+
   profile root {
     include <abstractions/base>
     include <abstractions/app/sudo>

apparmor.d/groups/xfce/xfce-power-manager

@@ -9,9 +9,16 @@ include <tunables/global>
 @{exec_path} = @{bin}/xfce4-power-manager
 profile xfce-power-manager @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/fontconfig-cache-read>
+  include <abstractions/bus-accessibility>
+  include <abstractions/bus-session>
+  include <abstractions/bus-system>
   include <abstractions/xfce>
   include <abstractions/nameservice-strict>
 
+  #aa:dbus own bus=session name=org.xfce.PowerManager
+  #aa:dbus own bus=session name=org.freedesktop.PowerManagement
+
   @{exec_path} mr,
 
   @{bin}/xfpm-power-backlight-helper rPx,

apparmor.d/groups/xfce/xfce-screensaver

@@ -9,11 +9,15 @@ include <tunables/global>
 @{exec_path} = @{bin}/xfce4-screensaver
 profile xfce-screensaver @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/bus-accessibility>
+  include <abstractions/bus-session>
   include <abstractions/authentication>
   include <abstractions/graphics>
   include <abstractions/xfce>
   include <abstractions/nameservice-strict>
 
+  #aa:dbus own bus=session name=org.xfce.ScreenSaver
+
   @{exec_path} mr,
 
   @{sh_path}    rix,

apparmor.d/groups/xfce/xfce-session

@@ -9,6 +9,10 @@ include <tunables/global>
 @{exec_path} = @{bin}/xfce4-session
 profile xfce-session @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/desktop>
+  include <abstractions/bus-session>
+  include <abstractions/bus-accessibility>
+  include <abstractions/fontconfig-cache-read>
   include <abstractions/app-launcher-user>
   include <abstractions/graphics>
   include <abstractions/nameservice-strict>
@@ -16,6 +20,8 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) {
 
   signal (receive) set=(term) peer=lightdm,
 
+  #aa:dbus own bus=session name=org.xfce.SessionManager
+
   @{exec_path} mr,
 
   @{sh_path} rix,
@@ -33,6 +39,7 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) {
   @{lib}/msgcollector/msgdispatcher_xdg_autostart      rPx,
   @{lib}/sdwdate-gui/start-maybe                       rPx,
   @{lib}/setup-wizard-dist/setup-dist_check_for_start  rPx,
+  @{lib}/xapps/sn-watcher/xapp-sn-watcher             rPUx,
 
   /usr/share/kde-power-savings-disable-in-vms/{,**} r,
   /usr/share/kde-screen-locker-disable-in-vms/{,**} r,
@@ -48,11 +55,15 @@ profile xfce-session @{exec_path} flags=(attach_disconnected) {
   /etc/xdg/autostart/*.desktop r,
 
   owner @{user_cache_dirs}/sessions/{,**} rw,
+  owner @{user_config_dirs}/autostart/ r,
+  owner @{user_config_dirs}/autostart/*.desktop r,
 
   owner @{tmp}/.xfsm-ICE-@{rand6} rw,
 
   owner @{PROC}/@{pid}/stat r,
 
+  @{sys}/class/i2c-adapter/ r,
+
   /dev/tty rw,
 
   profile systemctl flags=(attach_disconnected) {

apparmor.d/groups/xfce/xfce-terminal

@@ -9,6 +9,9 @@ include <tunables/global>
 @{exec_path} = @{bin}/xfce4-terminal
 profile xfce-terminal @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-accessibility>
+  include <abstractions/bus-session>
+  include <abstractions/bus-system>
   include <abstractions/audio-client>
   include <abstractions/consoles>
   include <abstractions/dconf-write>
@@ -16,6 +19,10 @@ profile xfce-terminal @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/xfce>
 
+  signal send,
+
+  #aa:dbus own bus=session name=org.xfce.Terminal5
+
   @{exec_path} mr,
 
   @{open_path} rPx -> child-open-help,
@@ -28,7 +35,10 @@ profile xfce-terminal @{exec_path} {
   @{bin}/micro               rPUx,
   @{bin}/nvtop                rPx,
 
+  @{editor_path} rPUx,
+
   /usr/share/ r,
+  /usr/share/desktop-base/profiles/xdg-config/ r,
   /usr/share/xfce4/ r,
   /usr/share/xfce4/terminal/{,**} r,
 
@@ -36,6 +46,7 @@ profile xfce-terminal @{exec_path} {
   /etc/xdg/ r,
   /etc/xdg/xfce4/ r,
 
+  owner @{user_config_dirs}/xfce4/ r,
   owner @{user_config_dirs}/xfce4/terminal/{,**} r,
 
   owner @{tmp}/#@{int} rw,

apparmor.d/groups/xfce/xfconfd

@@ -10,11 +10,14 @@ include <tunables/global>
 @{exec_path} = @{lib}/{,@{multiarch}/}xfce4/xfconf/xfconfd
 profile xfconfd @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-session>
   include <abstractions/xfce>
 
+  #aa:dbus own bus=session name=org.xfce.Xfconf
+
   @{exec_path} mr,
 
-  /etc/xdg/xfce4/xfconf/** r,
+  /etc/xdg/{,xdg-xubuntu/}xfce4/xfconf/** r,
 
   owner @{HOME}/ r,
 

apparmor.d/groups/xfce/xfdesktop

@@ -10,14 +10,23 @@ include <tunables/global>
 profile xfdesktop @{exec_path} {
   include <abstractions/base>
   include <abstractions/app-launcher-user>
+  include <abstractions/bus-accessibility>
+  include <abstractions/bus-session>
+  include <abstractions/fontconfig-cache-read>
   include <abstractions/nameservice-strict>
   include <abstractions/thumbnails-cache-read>
   include <abstractions/xfce>
 
+  #aa:dbus own bus=session name=org.xfce.xfdesktop
+
   @{exec_path} mr,
 
   @{bin}/xfce4-mime-helper rix,
 
+  /etc/xdg/{,xdg-xubuntu/}xfce4/helpers.rc r,
+  /etc/xdg/menus/{,*.menu} r,
+  /usr/share/xfce4/helpers/{,*.desktop} r,
+  /usr/share/desktop-directories/{,*.directory} r,
   /usr/share/backgrounds/xfce/{,**} r,
 
   /etc/fstab r,

apparmor.d/groups/xfce/xfsettingsd

@@ -10,8 +10,14 @@ include <tunables/global>
 profile xfsettingsd @{exec_path} {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
+  include <abstractions/bus-accessibility>
+  include <abstractions/bus-session>
+  include <abstractions/bus-system>
+  include <abstractions/fontconfig-cache-read>
   include <abstractions/xfce>
 
+  #aa:dbus own bus=session name=org.xfce.SettingsDaemon
+
   @{exec_path} mr,
 
   /etc/xdg/autostart/xfsettingsd.desktop r,

apparmor.d/groups/xfce/xfwm

@@ -9,6 +9,8 @@ include <tunables/global>
 @{exec_path} = @{bin}/xfwm4
 profile xfwm @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-accessibility>
+  include <abstractions/bus-session>
   include <abstractions/audio-client>
   include <abstractions/fontconfig-cache-write>
   include <abstractions/graphics>

apparmor.d/profiles-a-f/filezilla

@@ -29,6 +29,7 @@ profile filezilla @{exec_path} {
   network netlink raw,
 
   signal send set=(term, kill) peer=fzsftp,
+  signal send set=(term, kill) peer=fzputtygen,
 
   @{exec_path} mr,
 
@@ -36,6 +37,7 @@ profile filezilla @{exec_path} {
   @{bin}/uname       rix,
 
   @{bin}/fzsftp      rPx,  # When using SFTP protocol
+  @{bin}/fzputtygen rPUx,
   @{bin}/lsb_release rPx -> lsb_release,
 
   /usr/share/filezilla/{,**} r,

apparmor.d/profiles-g-l/gdk-pixbuf-thumbnailer

@@ -0,0 +1,15 @@
+# apparmor.d - Full set of apparmor profiles
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{bin}/gdk-pixbuf-thumbnailer
+profile gdk-pixbuf-thumbnailer @{exec_path} {
+  include <abstractions/base>
+
+  include if exists <local/gdk-pixbuf-thumbnailer>
+}
+
+# vim:syntax=apparmor

apparmor.d/profiles-g-l/iceauth

@@ -16,7 +16,7 @@ profile iceauth @{exec_path} {
   owner @{tmp}/.xfsm-ICE-@{rand6} r,
   owner @{tmp}/user/@{uid}/.xfsm-ICE-@{rand6} r,
 
-  owner @{run}/user/@{uid}/ICEauthority rl -> @{run}/user/@{uid}/ICEauthority-n,
+  owner @{run}/user/@{uid}/ICEauthority rwl -> @{run}/user/@{uid}/ICEauthority-n,
   owner @{run}/user/@{uid}/ICEauthority-c w,
   owner @{run}/user/@{uid}/ICEauthority-l wl -> @{run}/user/@{uid}/ICEauthority-c,
   owner @{run}/user/@{uid}/ICEauthority-n rw,

apparmor.d/profiles-g-l/im-launch

@@ -22,6 +22,7 @@ profile im-launch @{exec_path} {
   @{bin}/sed                   rix,
   @{bin}/sleep                 rix,
   @{bin}/startplasma-x11       rPx,
+  @{bin}/startxfce4            rPx,
   @{bin}/true                  rix,
   @{bin}/uim-toolbar-gtk3     rPUx,
   @{bin}/uim-xim              rPUx,

apparmor.d/profiles-g-l/libreoffice

@@ -74,11 +74,14 @@ profile libreoffice @{exec_path} {
   /usr/share/mythes/{,**} r,
   /usr/share/thumbnailers/{,**} r,
 
-  /etc/java{,@{version}}-openjdk/{,**} r,
+  /etc/java{,-}{,@{version}}-openjdk/{,**} r,
   /etc/libreoffice/{,**} r,
   /etc/paperspecs r,
+  /etc/papersize r,
   /etc/xdg/* r,
 
+  owner /var/spool/libreoffice/uno_packages/cache/stamp.sys w,
+
   owner @{user_cache_dirs}/libreoffice/{,**} rw,
   owner @{user_config_dirs}/libreoffice/ rw,
   owner @{user_config_dirs}/libreoffice/** rwk,
@@ -97,7 +100,7 @@ profile libreoffice @{exec_path} {
   owner @{tmp}/*.tmp/{,**} rwk,
   owner @{tmp}/hsperfdata_@{user}/  rw,
   owner @{tmp}/hsperfdata_@{user}/@{int} rwk,
-  owner @{tmp}/OSL_PIPE_@{uid}_SingleOfficeIPC_@{hex} w,
+  owner @{tmp}/OSL_PIPE_@{uid}_SingleOfficeIPC_@{hex32} rw,
 
   owner @{run}/user/@{uid}/#@{int} rw,
 
@@ -106,6 +109,7 @@ profile libreoffice @{exec_path} {
         @{sys}/kernel/mm/hugepages/ r,
         @{sys}/kernel/mm/transparent_hugepage/enabled r,
         @{sys}/kernel/mm/transparent_hugepage/shmem_enabled r,
+        @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
         @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/{cpu,memory}.max r,
   owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/**/memory.max r,
   owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/org.gnome.Shell@wayland.service/memory.max r,

apparmor.d/profiles-m-r/nemo

@@ -21,7 +21,12 @@ profile nemo @{exec_path} {
 
   @{exec_path} mr,
 
+  @{open_path} rPx -> child-open,
+
+  @{bin}/gdk-pixbuf-thumbnailer rPx,
+
   /usr/share/nemo/** r,
+  /usr/share/thumbnailers/{,*.thumbnailer} r,
 
   # Full access to user's data
   / r,

apparmor.d/profiles-m-r/remmina

@@ -22,6 +22,7 @@ profile remmina @{exec_path} {
   include <abstractions/bus/org.kde.StatusNotifierWatcher>
   include <abstractions/dconf-write>
   include <abstractions/desktop>
+  include <abstractions/fontconfig-cache-read>
   include <abstractions/ibus>
   include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
@@ -30,6 +31,8 @@ profile remmina @{exec_path} {
 
   network inet stream,
   network inet6 stream,
+  network inet dgram,
+  network inet6 dgram,
   network netlink raw,
 
   #aa:dbus own bus=session name=org.remmina.Remmina
@@ -63,6 +66,9 @@ profile remmina @{exec_path} {
 
   owner @{run}/user/@{uid}/keyring/ssh rw,
 
+  @{sys}/devices/system/node/ r,
+  @{sys}/devices/system/node/node@{int}/meminfo r,
+
   include if exists <local/remmina>
 }
 

apparmor.d/profiles-m-r/run-parts

@@ -255,6 +255,8 @@ profile run-parts @{exec_path} {
     @{run}/reboot-required w,
     @{run}/reboot-required.pkgs rw,
 
+    @{sys}/module/compression r,
+
     @{PROC}/devices r,
     @{PROC}/cmdline r,
 

apparmor.d/profiles-s-z/system-config-printer-applet

@@ -10,6 +10,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/system-config-printer-applet /usr/share/system-config-printer/applet.py
 profile system-config-printer-applet @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-session>
   include <abstractions/python>
   include <abstractions/nameservice-strict>
 

apparmor.d/profiles-s-z/ucf

@@ -0,0 +1,61 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2019-2022 Mikhail Morfikov
+# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{bin}/ucf
+profile ucf @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+  include <abstractions/perl>
+
+  @{exec_path} r,
+  @{sh_path}            rix,
+
+  @{bin}/{,e}grep       rix,
+  @{bin}/basename       rix,
+  @{bin}/cat            rix,
+  @{bin}/cp             rix,
+  @{bin}/dirname        rix,
+  @{bin}/{m,g,}awk      rix,
+  @{bin}/getopt         rix,
+  @{bin}/id             rix,
+  @{bin}/md5sum         rix,
+  @{bin}/mkdir          rix,
+  @{bin}/mv             rix,
+  @{bin}/readlink       rix,
+  @{bin}/rm             rix,
+  @{bin}/sed            rix,
+  @{bin}/seq            rix,
+  @{bin}/stat           rix,
+  @{bin}/tr             rix,
+  @{bin}/which{,.debianutils} rix,
+
+  @{bin}/dpkg-query     rpx,
+  @{bin}/dpkg-divert    rPx,
+  @{pager_path}         rCx -> child-pager,
+
+  /usr/share/debconf/frontend     rPx, # TODO: rCx -> debonc-frontend,
+
+  /usr/share/** r,
+
+  /etc/default/* rw,
+  /etc/libreoffice/registry/** r,
+  /etc/ucf.conf r,
+
+  /var/lib/ucf/** rw,
+
+  # For shell pwd
+  / r,
+  /root/ r,
+
+  owner /tmp/tmp.@{rand10} r,
+
+  include if exists <local/ucf>
+}
+
+# vim:syntax=apparmor

dists/flags/main.flags

@@ -111,6 +111,7 @@ flatpak-validate-icon complain
 fstrim complain
 fuse-overlayfs complain
 fusermount complain
+gdk-pixbuf-thumbnailer complain
 gdm-generate-config complain
 gdm-runtime-config complain
 gdm-session attach_disconnected,complain
@@ -215,6 +216,7 @@ libreoffice complain
 libvirt-dbus complain
 libvirtd attach_disconnected,complain
 lightdm attach_disconnected,complain
+lightdm-session complain
 locale-gen complain
 localectl complain
 localsearch complain
@@ -251,6 +253,7 @@ pam_kwallet_init complain
 pam-tmpdir-helper complain
 passimd attach_disconnected,complain
 pkttyagent complain
+pkla-admin-identities complain
 plank complain
 plasma_waitforname complain
 plasma-browser-integration-host complain
@@ -346,6 +349,7 @@ systemsettings complain
 telegram-desktop complain
 totem attach_disconnected,complain
 tracker-writeback complain
+ucf complain
 udev-dmi-memory-id complain
 udisksctl complain
 udisksd attach_disconnected,complain