feat(profiles): general update.

apparmor.d/groups/bus/dbus-daemon

@@ -22,7 +22,7 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
   capability sys_resource,
 
   network netlink raw,
-
+  network unix stream,
   network bluetooth stream,
   network bluetooth seqpacket,
 
@@ -36,8 +36,6 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
 
   ptrace (read),
 
-  unix (send receive accept) type=stream,
-
   @{exec_path} mr,
 
   @{bin}/ r,

apparmor.d/groups/freedesktop/xrandr

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -9,14 +10,10 @@ include <tunables/global>
 @{exec_path} = @{bin}/xrandr
 profile xrandr @{exec_path} {
   include <abstractions/base>
+  include <abstractions/X-strict>
 
   @{exec_path} mr,
 
-  owner @{HOME}/.Xauthority r,
-
-  /usr/share/X11/XErrorDB r,
-
-  # file_inherit
   owner /dev/tty@{int} rw,
 
   include if exists <local/xrandr>

apparmor.d/groups/gnome/gnome-shell

@@ -12,6 +12,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   include <abstractions/app-launcher-user>
   include <abstractions/audio>
   include <abstractions/dbus-accessibility-strict>
+  include <abstractions/dbus-gtk>
   include <abstractions/dbus-network-manager-strict>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>

apparmor.d/groups/gnome/kgx

@@ -50,5 +50,7 @@ profile kgx @{exec_path} {
         @{PROC}/1/cgroup r,
   owner @{PROC}/@{pid}/cgroup r,
 
+  /dev/ptmx rw,
+
   include if exists <local/kgx>
 }

apparmor.d/groups/gnome/tracker-extract

@@ -84,6 +84,7 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) {
 
   /usr/share/dconf/profile/gdm r,
   /usr/share/drirc.d/{,*.conf} r,
+  /usr/share/gdm/greeter/applications/*.desktop r,
   /usr/share/gvfs/remote-volume-monitors/{,*} r,
   /usr/share/hwdata/*.ids r,
   /usr/share/ladspa/rdf/{,**} r,

apparmor.d/groups/pacman/pacman

@@ -35,6 +35,7 @@ profile pacman @{exec_path} {
   network inet dgram,
   network inet6 dgram,
   network netlink raw,
+  network unix stream,
 
   ptrace (read),