feat: update profiles.

apparmor.d/groups/apt/apt

@@ -8,7 +8,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}bin/apt
-profile apt @{exec_path} flags=(complain) {
+profile apt @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/apt-common>
   include <abstractions/consoles>
@@ -84,6 +84,7 @@ profile apt @{exec_path} flags=(complain) {
   # For package building
   @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
 
+  @{run}/systemd/inhibit/[0-9]*.ref rw,
 
   profile editor flags=(complain) {
     include <abstractions/base>

apparmor.d/groups/apt/dpkg-status

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}lib/needrestart/dpkg-status
 profile dpkg-status @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
 
   @{exec_path} mr,
 

apparmor.d/groups/apt/unattended-upgrade

@@ -24,11 +24,12 @@ profile unattended-upgrade @{exec_path} {
 
   /{usr/,}bin/ r,
 
-  /{usr/,}bin/dpkg            rPx,
-  /{usr/,}bin/lsb_release     rPx -> lsb_release,
-  /{usr/,}bin/python3.[0-9]*  rix,
-  /{usr/,}bin/uname           rix,
-  /{usr/,}lib/apt/methods/http{,s} rPx,
+  /{usr/,}{s,}bin/on_ac_power       rPx,
+  /{usr/,}bin/dpkg                  rPx,
+  /{usr/,}bin/lsb_release           rPx -> lsb_release,
+  /{usr/,}bin/python3.[0-9]*        rix,
+  /{usr/,}bin/uname                 rix,
+  /{usr/,}lib/apt/methods/http{,s}  rPx,
 
   /usr/share/dpkg/*table r,
 
@@ -43,9 +44,11 @@ profile unattended-upgrade @{exec_path} {
 
   /var/lib/apt/extended_states r,
   /var/lib/apt/lists/{,**} r,
+  /var/lib/apt/periodic/unattended-upgrades-stamp w,
   /var/lib/dpkg/lock rwk,
   /var/lib/dpkg/lock-frontend rwk,
   /var/lib/dpkg/status r,
+  /var/lib/dpkg/updates/ r,
 
   /var/cache/apt/archives/{,**} rw,
   /var/cache/apt/pkgcache.bin r,

apparmor.d/groups/apt/unattended-upgrade-shutdown

@@ -17,10 +17,12 @@ profile unattended-upgrade-shutdown @{exec_path} flags=(attach_disconnected) {
   /usr/share/unattended-upgrades/{,*} r,
   /etc/apt/apt.conf.d/{,*} r,
 
-  owner /var/log/unattended-upgrades/*.log rw,
+  owner /var/log/unattended-upgrades/*.log* rw,
 
   owner @{run}/unattended-upgrades.lock rwk,
   owner @{run}/systemd/inhibit/[0-9]*.ref rw,
 
+  owner @{PROC}/@{pid}/mounts r,
+
   include if exists <local/unattended-upgrade-shutdown>
 }

apparmor.d/groups/browsers/firefox

@@ -126,7 +126,6 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
   owner @{user_cache_dirs}/mozilla/** rwk,
 
   owner @{user_share_dirs}/ r,
-  owner @{user_share_dirs}/gvfs-metadata/{,*} r,
   owner @{user_share_dirs}/mime/packages/user-extension-{htm,html,xht,xhtml,shtml}.xml rw,
   owner @{user_share_dirs}/mime/packages/user-extension-{htm,html,xht,xhtml,shtml}.xml.* rw,
 
@@ -189,6 +188,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
   # Silencer
   deny /{usr/,}lib/firefox/** w,
   deny capability sys_ptrace,
+  deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
   deny owner @{HOME}/.* r,
 
   profile open {

apparmor.d/groups/browsers/firefox-crashreporter

@@ -64,5 +64,8 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) {
   /dev/dri/card[0-9]* rw,
   /dev/dri/renderD128 rw,
 
+  # Silencer
+  deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
+
   include if exists <local/firefox-crashreporter>
 }

apparmor.d/groups/browsers/firefox-minidump-analyzer

@@ -34,7 +34,19 @@ profile firefox-minidump-analyzer @{exec_path} {
 
   owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* r,
 
+  owner @{PROC}/@{pid}/task/@{tid}/stat r,
+  owner @{PROC}/@{pid}/stat r,
+
   /dev/dri/renderD128 rw,
 
+  # Silencer
+  deny network inet dgram,
+  deny network inet6 dgram,
+  deny network inet stream,
+  deny network inet6 stream,
+  deny network netlink raw,
+  deny owner @{MOZ_HOMEDIR}/firefox/*/extensions/*.xpi r,
+  deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
+
   include if exists <local/firefox-minidump-analyzer>
 }

apparmor.d/groups/bus/dbus-daemon

@@ -61,6 +61,7 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
         @{run}/systemd/inhibit/[0-9]*.ref rw,
         @{run}/systemd/sessions/[0-9]*.ref rw,
         @{run}/systemd/users/@{uid} r,
+  owner @{run}/user/@{uid}/at-spi/bus rw,
   owner @{run}/user/@{uid}/dbus-1/ rw,
   owner @{run}/user/@{uid}/dbus-1/services/ rw,
 

apparmor.d/groups/bus/dbus-run-session

@@ -11,8 +11,7 @@ profile dbus-run-session @{exec_path} {
   include <abstractions/base>
   include <abstractions/dconf>
 
-  signal (receive) set=term peer=gdm,
-  signal (receive) set=(term, kill) peer=gdm-*-session,
+  signal (receive) set=(term, kill, hup) peer=gdm*,
   signal (send) set=term peer=dbus-daemon,
 
   @{exec_path} mr,
@@ -29,6 +28,7 @@ profile dbus-run-session @{exec_path} {
   owner @{run}/user/@{uid}/dconf/ rw,
   owner @{run}/user/@{uid}/dconf/user rw,
   /var/lib/gdm/.config/dconf/user r,
+  /var/lib/gdm/.cache/dconf/ rw,
 
   owner @{PROC}/@{pid}/fd/ r,
 

apparmor.d/groups/cron/cron

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2019-2022 Mikhail Morfikov
+# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -21,6 +22,8 @@ profile cron @{exec_path} {
 
   network netlink raw,
 
+  ptrace (read) peer=unconfined,
+
   @{exec_path} mr,
 
   /{usr/,}bin/{,ba,da}sh rix,
@@ -37,6 +40,7 @@ profile cron @{exec_path} {
   /{usr/,}sbin/e2scrub_all             rPUx,
   /etc/cron.daily/popularity-contest    rPx,
   /{usr/,}lib/sysstat/debian-sa1       rPUx,
+  /{usr/,}{s,}bin/sendmail             rPUx,
 
   # All stuff that is executed via the user crontab files
   /{usr/,}bin/apt-file                  rPx,

apparmor.d/groups/gnome/gnome-control-center

@@ -95,11 +95,12 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
   @{sys}/class/ r,
   @{sys}/class/input/ r,
   @{sys}/devices/**/{name,vendor,product,uevent} r,
-  @{sys}/devices/platform/**/uevent r,
-  @{sys}/devices/virtual/**/uevent r,
   @{sys}/devices/pci[0-9]*/**/drm/ r,
   @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/id r,
   @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/gt_*_mhz r,
+  @{sys}/devices/pci[0-9]*/**/revision r,
+  @{sys}/devices/platform/**/uevent r,
+  @{sys}/devices/virtual/**/uevent r,
   @{sys}/devices/virtual/dmi/id/chassis_type r,
   @{sys}/devices/virtual/thermal/thermal_zone[0-9]/hwmon[0-9]/temp* r,
 

apparmor.d/groups/gnome/gnome-control-center-print-renderer

@@ -40,6 +40,7 @@ profile gnome-control-center-print-renderer @{exec_path} {
   @{sys}/devices/pci[0-9]*/**/drm/ r,
   @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/id r,
   @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/gt_*_mhz r,
+  @{sys}/devices/pci[0-9]*/**/revision r,
 
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/comm r,

apparmor.d/groups/gnome/gnome-terminal-server

@@ -19,7 +19,8 @@ profile gnome-terminal-server @{exec_path} {
 
   @{exec_path} mr,
 
-  /{usr/,}bin/{,z,ba,da}sh rux,
+  # The shell is not confined on purpose.
+  /{usr/,}bin/{,z,ba,da}sh rUx,
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /usr/share/X11/xkb/{,**} r,

apparmor.d/groups/gnome/nautilus

@@ -35,12 +35,11 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
   owner /tmp/{,**} rw,
 
   # Silence non user's data
-  deny owner @{HOME}/@{XDG_VM_DIR}/{,**} rw,
-  deny /boot rw,
-  deny /opt rw,
-  deny /root rw,
+  deny /boot/{,**} r,
+  deny /opt/{,**} r,
+  deny /root/{,**} r,
   deny /tmp/.* rw,
-  deny /tmp/.*/ rw,
+  deny /tmp/.*/{,**} rw,
 
   owner @{run}/user/@{uid}/dconf/ rw,
   owner @{run}/user/@{uid}/dconf/user rw,

apparmor.d/groups/ssh/ssh-keygen

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2022 Roman Beslik <me@beroal.in.ua>
+# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -10,12 +11,14 @@ include <tunables/global>
 
 profile ssh-keygen @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
   include <abstractions/nameservice-strict>
   include <abstractions/openssl>
-  include <abstractions/consoles> # for entering a passphrase for a key
 
   @{exec_path} mr,
 
+  /etc/ssh/ssh_host_*_key* rw,
+
   owner @{HOME}/@{XDG_SSH_DIR}/ w,
   owner @{HOME}/@{XDG_SSH_DIR}/*_*{,.pub} rw,
 

apparmor.d/groups/systemd/systemd-udevd

@@ -25,6 +25,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
   capability sys_admin,
   capability sys_module,
   capability sys_ptrace,
+  capability sys_rawio,
   capability sys_resource,
 
   ptrace (read),