feat(profile): general update.

apparmor.d/profiles-s-z/YACReader

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/YACReader
 profile YACReader @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   include <abstractions/base>
+  include <abstractions/audio-client>
   include <abstractions/dconf-write>
   include <abstractions/desktop>
   include <abstractions/graphics>
@@ -36,11 +37,6 @@ profile YACReader @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   owner @{user_share_dirs}/YACReader/YACReader/ rw,
   owner @{user_share_dirs}/YACReader/YACReader/** rwlk,
 
-  owner @{user_config_dirs}/pulse/client.conf r,
-  owner @{user_config_dirs}/pulse/cookie rk,
-
-  owner @{run}/user/@{uid}/pulse/ r,
-
   /dev/shm/ r,
 
   owner @{PROC}/@{pid}/cmdline r,

apparmor.d/profiles-s-z/spice-vdagent

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/spice-vdagent
 profile spice-vdagent @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/audio-client>
   include <abstractions/audio-server>
   include <abstractions/bus-accessibility>
   include <abstractions/bus-session>

apparmor.d/profiles-s-z/umount

@@ -46,8 +46,7 @@ profile umount @{exec_path} {
   owner @{PROC}/@{pid}/mountinfo r,
 
   owner @{run}/mount/ rw,
-  owner @{run}/mount/utab.lock wk,
-        @{run}/mount/utab{,.*} rw,
+  owner @{run}/mount/utab{,.*} rwk,
 
   include if exists <local/umount>
 }

apparmor.d/profiles-s-z/update-cracklib

@@ -11,6 +11,8 @@ profile update-cracklib @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
 
+  capability dac_read_search,
+
   @{exec_path} mr,
 
   @{sh_path}                  rix,

apparmor.d/profiles-s-z/vlc

@@ -85,8 +85,6 @@ profile vlc @{exec_path} {
 
   @{bin}/xdg-screensaver rPx,
 
-  /usr/share/hwdata/pnp.ids r,
-  /usr/share/qt5ct/** r,
   /usr/share/vlc/{,**} r,
 
   /etc/fstab r,

apparmor.d/profiles-s-z/vlc-cache-gen

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{lib}/vlc/vlc-cache-gen
 profile vlc-cache-gen @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
 
   @{exec_path} mr,
 

apparmor.d/profiles-s-z/wireshark

@@ -1,6 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2002-2005 Novell/SUSE
-#               2018-2021 Mikhail Morfikov
+# Copyright (C) 2018-2021 Mikhail Morfikov
 # Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
@@ -8,60 +8,47 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-# pcap pcapng
-@{wireshark_ext} = [pP][cC][aA][pP]{,[nN][gG]}
-
 @{exec_path} = @{bin}/wireshark
 profile wireshark @{exec_path} {
   include <abstractions/base>
   include <abstractions/bus-accessibility>
   include <abstractions/bus-session>
   include <abstractions/consoles>
-  include <abstractions/dri-enumerate>
-  include <abstractions/fontconfig-cache-read>
-  include <abstractions/fonts>
-  include <abstractions/freedesktop.org>
-  include <abstractions/gtk>
-  include <abstractions/mesa>
-  include <abstractions/nameservice>
-  include <abstractions/nvidia>
-  include <abstractions/private-files-strict>
-  include <abstractions/qt5-compose-cache-write>
-  include <abstractions/qt5-settings-write>
+  include <abstractions/desktop>
+  include <abstractions/graphics>
+  include <abstractions/nameservice-strict>
   include <abstractions/user-download-strict>
-  include <abstractions/X>
+  include <abstractions/user-read>
+
+  network inet dgram,
+  network inet6 dgram,
+  network inet stream,
+  network inet6 stream,
+  network netlink raw,
 
   signal (send) peer=dumpcap,
 
   @{exec_path} mr,
 
   @{bin}/dumpcap          rPx,
-  @{bin}/xdg-open         rCx -> open,
+  @{open_path}            rPx -> child-open-browsers,
 
-  # For reading pcaps
-        / r,
-        /tmp/ r,
-        /home/ r,
-  owner @{HOME}/ r,
-  owner @{HOME}/**/ r,
-        @{MOUNTS}/ r,
-  owner @{MOUNTS}/**/ r,
-  owner /{tmp,home,media}/**.@{wireshark_ext}{,.gz} rw,
-
-  # Wireshark files
-  /usr/share/wireshark/** r,
   @{lib}/@{multiarch}/wireshark/extcap/* rix,
   @{lib}/@{multiarch}/wireshark/plugins/*/{codecs,epan,wiretap}/*.so mr,
-  /etc/wireshark/init.lua r,
 
-  # Wireshark home files
+  /usr/share/GeoIP/{,**} r,
+  /usr/share/wireshark/** r,
+
+  /etc/wireshark/init.lua r,
+  /etc/fstab r,
+
+  # For reading pcaps
+  owner @{user_projects_dirs}/{,**} r,
+
   owner @{HOME}/.wireshark/{,**} rw,
   owner @{user_config_dirs}/wireshark/{,**} rw,
 
-  # To configure Qt5 settings (theme, font, icons, etc.) under DE/WM without Qt integration
-  owner @{user_config_dirs}/qt5ct/{,**} r,
-  /usr/share/qt5ct/** r,
-  /usr/share/qt5/translations/*.qm r,
+  owner /tmp/wireshark_extcap_ciscodump_@{int}_* rw,
 
   deny       @{PROC}/sys/kernel/random/boot_id r,
   deny owner @{PROC}/@{pid}/cmdline r,
@@ -71,46 +58,8 @@ profile wireshark @{exec_path} {
              @{PROC}/@{pid}/mountinfo r,
              @{PROC}/@{pid}/mounts r,
 
-  /etc/fstab r,
-
-  /usr/share/hwdata/pnp.ids r,
-
-  /usr/share/GeoIP/{,**} r,
-
-  /dev/shm/#@{int} rw,
-
-  owner /tmp/wireshark_extcap_ciscodump_@{int}_* rw,
-
-  # Allowed apps to open
-  @{lib}/firefox/firefox rPUx,
-
-  # file_inherit
+  owner /dev/shm/#@{int} rw,
   owner /dev/tty@{int} rw,
 
-
-  profile open {
-    include <abstractions/base>
-    include <abstractions/xdg-open>
-
-    @{bin}/xdg-open mr,
-
-    @{sh_path}             rix,
-    @{bin}/{m,g,}awk       rix,
-    @{bin}/readlink        rix,
-    @{bin}/basename        rix,
-
-    owner @{HOME}/ r,
-
-    owner @{run}/user/@{uid}/ r,
-
-    # Allowed apps to open
-    @{lib}/firefox/firefox rPUx,
-
-    # file_inherit
-    owner @{HOME}/.xsession-errors w,
-
-    include if exists <local/wireshark_open>
-  }
-
   include if exists <local/wireshark>
 }