feat(profile): include more rule from #94.

apparmor.d/groups/gnome/gnome-characters

@@ -0,0 +1,32 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /usr/share/org.gnome.Characters/org.gnome.Characters
+profile gnome-characters @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/dconf-write>
+  include <abstractions/fontconfig-cache-read>
+  include <abstractions/fonts>
+  include <abstractions/freedesktop.org>
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/gjs-console rix,
+
+  /usr/share/glib-2.0/schemas/gschemas.compiled r,
+  /usr/share/org.gnome.Characters/org.gnome.Characters.BackgroundService.*.gresource r,
+  /usr/share/themes/{,**} r,
+  /usr/share/X11/xkb/{,**} r,
+
+  owner @{PROC}/@{pid}/mounts r,
+  owner @{PROC}/@{pid}/stat r,
+  owner @{PROC}/@{pid}/status r,
+  owner @{PROC}/@{pid}/task/@{tid}/stat r,
+
+  include if exists <local/gnome-characters>
+}

apparmor.d/groups/gnome/gnome-session-binary

@@ -162,6 +162,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
   /{usr/,}bin/gnome-shell                                  rPx,
   /{usr/,}bin/gnome-software                              rPUx,
   /{usr/,}bin/im-launch                                    rPx,
+  /{usr/,}bin/keepassxc                                    rPx,
   /{usr/,}bin/parcellite                                  rPUx,
   /{usr/,}bin/pkcs11-register                              rPx,
   /{usr/,}bin/snap                                        rPUx,

apparmor.d/groups/gnome/gnome-shell

@@ -507,6 +507,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   /usr/share/wayland-sessions/{,*.desktop} r,
   /usr/share/xml/iso-codes/iso_[0-9]*-[0-9]*.xml r,
   /usr/share/desktop-base/** r,
+  /usr/share/libdrm/*.ids r,
 
   /.flatpak-info r,
   /etc/fstab r,
@@ -514,6 +515,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
 
   /var/lib/gdm{3,}/.cache/ w,
   /var/lib/gdm{3,}/.cache/event-sound-cache.tdb.*.x86_64-pc-linux-gnu rwk,
+  /var/lib/gdm{3,}/.cache/fontconfig/* rw, 
   /var/lib/gdm{3,}/.cache/gstreamer-[0-9]*/ rw,
   /var/lib/gdm{3,}/.cache/gstreamer-[0-9]*/registry.*.bin{,.tmp*} rw,
   /var/lib/gdm{3,}/.cache/libgweather/ r,
@@ -566,8 +568,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   owner @{user_cache_dirs}/gnome-boxes/*.png r,
   owner @{user_cache_dirs}/gnome-photos/{,**} r,
   owner @{user_cache_dirs}/gnome-screenshot/{,**} rw,
-  owner @{user_cache_dirs}/libgweather/ w,
-  owner @{user_cache_dirs}/libgweather/{,**} r,
+  owner @{user_cache_dirs}/libgweather/{,**} rw,
   owner @{user_cache_dirs}/media-art/{,**} r,
   owner @{user_cache_dirs}/vlc/**/*.jpg r,
 
@@ -624,6 +625,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   @{sys}/devices/pci[0-9]*/**/drm/ r,
   @{sys}/devices/pci[0-9]*/**/input[0-9]*/{properties,name} r,
   @{sys}/devices/pci[0-9]*/**/net/*/statistics/{rx_bytes,tx_bytes} r,
+  @{sys}/devices/platform/**/input[0-9]*/{properties,name} r,
   @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_cur_freq r,
   @{sys}/devices/virtual/net/*/statistics/{rx_bytes,tx_bytes} r,
 

apparmor.d/groups/gnome/gsd-datetime

@@ -57,10 +57,15 @@ profile gsd-datetime @{exec_path} flags=(attach_disconnected) {
   /usr/share/dconf/profile/gdm r,
   /usr/share/gdm/greeter-dconf-defaults r,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
+  /usr/share/gnome-settings-daemon/datetime/backward r,
 
   /var/lib/gdm{3,}/.config/dconf/user r,
   /var/lib/gdm{3,}/greeter-dconf-defaults r,
 
+  owner @{user_cache_dirs}/geocode-glib/* r,
+
+  owner @{PROC}/@{pid}/stat r,
+
   owner /dev/tty[0-9]* rw,
 
   include if exists <local/gsd-datetime>

apparmor.d/groups/gnome/gsd-media-keys

@@ -189,5 +189,8 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
   @{sys}/devices/platform/**/uevent r,
   @{sys}/devices/**/usb[0-9]/{,**} r,
 
+        @{PROC}/1/cgroup r,
+  owner @{PROC}/@{pid}/cgroup r,
+
   include if exists <local/gsd-media-keys>
 }

apparmor.d/groups/gnome/gsd-xsettings

@@ -129,7 +129,7 @@ profile gsd-xsettings @{exec_path} {
 
   /usr/share/dconf/profile/gdm r,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
-  /usr/share/gdm/greeter-dconf-defaults r,
+  /usr/share/libdrm/*.ids r,
 
   /etc/X11/Xsession.options r,
   /etc/xdg/Xwayland-session.d/ r,

apparmor.d/groups/gnome/nautilus

@@ -46,6 +46,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
   /{usr/,}lib/gio-launch-desktop  rPx -> child-open,
 
   /usr/share/*ubuntu/applications/{,**} r,
+  /usr/share/libdrm/*.ids r,
   /usr/share/nautilus/{,**} r,
   /usr/share/poppler/{,**} r,
   /usr/share/sounds/freedesktop/stereo/*.oga r,