feat(profile): general update.

apparmor.d/groups/gnome/gnome-extensions-app

@@ -15,6 +15,7 @@ profile gnome-extensions-app @{exec_path} {
   include <abstractions/fonts>
   include <abstractions/freedesktop.org>
   include <abstractions/mesa>
+  include <abstractions/nameservice-strict>
   include <abstractions/opencl>
   include <abstractions/vulkan>
 

apparmor.d/groups/gnome/gnome-music

@@ -45,7 +45,7 @@ profile gnome-music @{exec_path} {
   owner @{user_music_dirs}/{,**} r,
 
   owner @{user_cache_dirs}/gnome-music/{,**} rwk,
-  owner @{user_cache_dirs}/media-art/album-*.jpeg rw,
+  owner @{user_cache_dirs}/media-art/{,*} rw,
   owner @{user_share_dirs}/grilo-plugins/ rwk,
   owner @{user_share_dirs}/grilo-plugins/*.db{,-shm,-journal,-wal} rwk,
 
@@ -54,6 +54,7 @@ profile gnome-music @{exec_path} {
 
   owner /tmp/grilo-plugin-cache-[0-9A-Z]*/ rw,
 
+  owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/mounts r,
 
   deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,

apparmor.d/groups/gnome/gnome-tweaks

@@ -37,7 +37,7 @@ profile gnome-tweaks @{exec_path} {
   owner @{user_share_dirs}/backgrounds/{,**} r,
   owner @{user_share_dirs}/gnome-shell/extensions/**/schemas/* r,
   owner @{user_share_dirs}/recently-used.xbel* rw,
-  owner @{user_share_dirs}/sounds/ r,
+  owner @{user_share_dirs}/sounds/{,**} r,
 
   owner @{PROC}/@{pid}/fd/ r,
 

apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor

@@ -9,7 +9,7 @@ include <tunables/global>
 
 @{exec_path}  = /{usr/,}lib/gvfs/gvfs-udisks2-volume-monitor
 @{exec_path} += @{libexec}/gvfs-udisks2-volume-monitor
-profile gvfs-udisks2-volume-monitor @{exec_path} {
+profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
@@ -19,6 +19,8 @@ profile gvfs-udisks2-volume-monitor @{exec_path} {
   include <abstractions/freedesktop.org>
   include <abstractions/nameservice-strict>
 
+  capability sys_ptrace,
+
   network inet stream,
   network inet6 stream,
   network netlink raw,
@@ -74,18 +76,22 @@ profile gvfs-udisks2-volume-monitor @{exec_path} {
   owner @{HOME}/**/ r,
 
   @{run}/mount/utab r,
+  @{run}/systemd/inhibit/*.ref r,
   @{run}/systemd/sessions/* r,
 
+        @{PROC}/ r,
+        @{PROC}/@{pids}/net/* r,
+        @{PROC}/@{pids}/stat r,
+        @{PROC}/1/cgroup r,
+        @{PROC}/locks r,
   owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/fdinfo/[0-9]* r,
   owner @{PROC}/@{pid}/mountinfo r,
   owner @{PROC}/@{pid}/mounts r,
-        @{PROC}/@{pids}/net/* r,
-        @{PROC}/ r,
-        @{PROC}/@{pids}/stat r,
-        @{PROC}/1/cgroup r,
-        @{PROC}/locks r,
+
+  /dev/dri/card[0-9]* r,
+  /dev/input/event[0-9]* r,
 
   include if exists <local/gvfs-udisks2-volume-monitor>
 }

apparmor.d/groups/systemd/systemd-journald

@@ -48,7 +48,7 @@ profile systemd-journald @{exec_path} {
   @{run}/udev/data/+usb:*       r,
   @{run}/udev/data/+virtio:*    r,
   @{run}/udev/data/c1:[0-9]*    r,
-  @{run}/udev/data/c10:224      r, # for /dev/tpm0
+  @{run}/udev/data/c10:[0-9]*   r, # for /dev/tpm0
   @{run}/udev/data/c189:[0-9]*  r, # for /dev/bus/usb/**
   @{run}/udev/data/c23[0-9]:[0-9]* r,
   @{run}/udev/data/c24[0-9]:[0-9]* r,