From 226cb23073efb628f344c5c1985a543564671ee0 Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Sat, 21 Jun 2025 19:53:26 +0200
Subject: [PATCH] feat(profile): small improvement to steam.

---
 apparmor.d/groups/steam/steam              | 4 ++++
 apparmor.d/groups/steam/steamerrorreporter | 2 --
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/apparmor.d/groups/steam/steam b/apparmor.d/groups/steam/steam
index 73c78f2ed..151a3e161 100644
--- a/apparmor.d/groups/steam/steam
+++ b/apparmor.d/groups/steam/steam
@@ -109,6 +109,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   @{runtime_dirs}/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-*                  rix,
   @{runtime_dirs}/@{lib}/steam-runtime-tools-@{int}/srt-logger                      rix,
   @{runtime_dirs}/pressure-vessel/@{bin}/pressure-vessel-*                          rix,
+  @{runtime_dirs}/pressure-vessel/@{bin}/pv-*                                       rix,
   @{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/@{multiarch}-*  rix,
   @{runtime_dirs}/pressure-vessel/@{lib}/steam-runtime-tools-@{int}/srt-bwrap       rcx -> web,
   @{runtime_dirs}/run{,.sh}                                                         rix,
@@ -370,6 +371,8 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) {
     /dev/hidraw@{int} rw,
     /dev/tty rw,
 
+    @{att}/dev/dri/renderD128 rw,
+
     include if exists <local/steam_web>
   }
 
@@ -380,6 +383,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) {
 
     capability dac_override,
     capability dac_read_search,
+    capability sys_ptrace,
 
     unix receive type=stream,
 
diff --git a/apparmor.d/groups/steam/steamerrorreporter b/apparmor.d/groups/steam/steamerrorreporter
index b4d5f3e68..d438c604d 100644
--- a/apparmor.d/groups/steam/steamerrorreporter
+++ b/apparmor.d/groups/steam/steamerrorreporter
@@ -34,8 +34,6 @@ profile steamerrorreporter @{exec_path} flags=(attach_disconnected) {
   owner @{tmp}/dumps/ r,
   owner @{tmp}/dumps/*_log.txt rw,
 
-  owner @{PROC}/@{pid}/status r,
-
   include if exists <local/steamerrorreporter>
 }