feat(kde): add more kde profiles.

apparmor.d/groups/kde/drkonqi

@@ -0,0 +1,28 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{libexec}/drkonqi
+profile drkonqi @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/qt5>
+  include <abstractions/freedesktop.org>
+
+  network inet stream,
+  network inet6 stream,
+  network netlink raw,
+
+  @{exec_path} mr,
+
+  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+
+  @{run}/user/@{uid}/xauth_* rl,
+
+  /dev/tty r,
+
+  include if exists <local/drkonqi>
+}

apparmor.d/groups/kde/kalendarac

@@ -0,0 +1,47 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/kalendarac
+profile kalendarac @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/dri-common>
+  include <abstractions/freedesktop.org>
+  include <abstractions/nameservice-strict>
+  include <abstractions/qt5>
+  include <abstractions/mesa>
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/akonadi_control rPx,
+
+  /usr/share/akonadi/firstrun/{,*} r,
+  /usr/share/hwdata/*.ids r,
+  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+
+  /etc/machine-id r,
+  /etc/xdg/kdeglobals r,
+
+  owner @{user_cache_dirs}/icon-cache.kcache rw,
+
+  owner @{user_config_dirs}/#[0-9]* rw,
+  owner @{user_config_dirs}/akonadi-firstrunrc r,
+  owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
+  owner @{user_config_dirs}/kalendaracrc rw,
+  owner @{user_config_dirs}/kalendaracrc.?????? rwl,
+  owner @{user_config_dirs}/kalendaracrc.lock rwk,
+  owner @{user_config_dirs}/kdedefaults/kdeglobals r,
+  owner @{user_config_dirs}/kdeglobals r,
+
+  @{run}/user/@{uid}/xauth_* rl,
+
+  @{PROC}/sys/kernel/core_pattern r,
+
+  /dev/tty r,
+
+  include if exists <local/kalendarac>
+}

apparmor.d/groups/kde/kauth-fontinst

@@ -0,0 +1,19 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{libexec}/kauth/fontinst
+profile kauth-fontinst @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/qt5>
+
+  @{exec_path} mr,
+
+  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+
+  include if exists <local/kauth-fontinst>
+}

apparmor.d/groups/kde/kcminit

@@ -0,0 +1,49 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/kcminit
+profile kcminit @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/fonts>
+  include <abstractions/gtk>
+  include <abstractions/qt5>
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/xrdb rPx,
+
+  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/hwdata/pnp.ids r,
+
+  /etc/machine-id r,
+  /etc/xdg/kcmdisplayrc r,
+  /etc/xdg/kcminputrc r,
+  /etc/xdg/kdeglobals r,
+
+  owner @{user_config_dirs}/#[0-9]* rw,
+  owner @{user_config_dirs}/gtkrc-2.0{,.??????} rwl,
+  owner @{user_config_dirs}/gtkrc{,.??????} rwl,
+  owner @{user_config_dirs}/kcminputrc r,
+  owner @{user_config_dirs}/kdedefaults/kcminputrc r,
+  owner @{user_config_dirs}/kdedefaults/kdeglobals r,
+  owner @{user_config_dirs}/kdeglobals r,
+  owner @{user_config_dirs}/kgammarc r,
+  owner @{user_config_dirs}/Trolltech.conf.lock rwk,
+  owner @{user_config_dirs}/Trolltech.conf{,.??????} rwl,
+
+  owner /tmp/kcminit.?????? rwl,
+  owner /tmp/#[0-9]* rw,
+
+  @{run}/user/@{uid}/xauth_* rl,
+
+  @{PROC}/sys/kernel/random/boot_id r,
+
+  /dev/tty r,
+
+  include if exists <local/kcminit>
+}

apparmor.d/groups/kde/kde-powerdevil

@@ -0,0 +1,46 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{libexec}/org_kde_powerdevil
+profile kde-powerdevil @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+  include <abstractions/qt5>
+  include <abstractions/X-strict>
+
+  capability wake_alarm,
+
+  network netlink raw,
+
+  @{exec_path} mrix,
+
+  @{libexec}/drkonqi rPx,
+
+  /usr/share/hwdata/*.ids r,
+  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+
+  /etc/fstab r,
+  /etc/xdg/kdeglobals r,
+
+  owner @{user_cache_dirs}/kcrash-metadata/{,*} rw,
+
+  owner @{user_config_dirs}/kdedefaults/kdeglobals r,
+  owner @{user_config_dirs}/kdeglobals r,
+  owner @{user_config_dirs}/powerdevilrc r,
+  owner @{user_config_dirs}/powermanagementprofilesrc r,
+
+        @{run}/systemd/inhibit/*.ref rw,
+  owner @{run}/user/@{uid}kcrash_[0-9]* rw,
+
+  @{PROC}/sys/kernel/core_pattern r,
+  @{PROC}/@{pid}/mounts r,
+
+  /dev/tty rw,
+  /dev/rfkill r,
+
+  include if exists <local/kde-powerdevil>
+}

apparmor.d/groups/kde/kio_http_cache_cleaner

@@ -0,0 +1,16 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{libexec}/kf5/kio_http_cache_cleaner
+profile kio_http_cache_cleaner @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  include if exists <local/kio_http_cache_cleaner>
+}

apparmor.d/groups/kde/kioslave5

@@ -0,0 +1,65 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{libexec}/kf5/kioslave5
+profile kioslave5 @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/dri-common>
+  include <abstractions/fonts>
+  include <abstractions/freedesktop.org>
+  include <abstractions/mesa>
+  include <abstractions/nameservice-strict>
+  include <abstractions/qt5>
+  include <abstractions/trash>
+
+  network netlink raw,
+
+  signal (receive) set=term peer=plasmashell,
+
+  @{exec_path} mr,
+
+  @{libexec}/libheif/ r,
+  @{libexec}/libheif/*.so* rm,
+
+  /usr/share/hwdata/*.ids r,
+  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/kservices5/{,**} r,
+  /usr/share/kservicetypes5/*.desktop r,
+
+  /etc/fstab r,
+  /etc/xdg/kdeglobals r,
+  /etc/xdg/kioslaverc r,
+  /etc/xdg/kwinrc r,
+  /etc/xdg/menus/{,**} r,
+
+  owner @{HOME}/@{XDG_DESKTOP_DIR}/ r,
+  owner @{HOME}/@{XDG_DESKTOP_DIR}/*.desktop r,
+
+  owner @{user_cache_dirs}/ksycoca5_* r,
+  owner @{user_cache_dirs}/thumbnails/*/ r,
+
+  owner @{user_config_dirs}/kdedefaults/kdeglobals r,
+  owner @{user_config_dirs}/kdedefaults/kwinrc r,
+  owner @{user_config_dirs}/kdeglobals r,
+  owner @{user_config_dirs}/kwinrc r,
+
+  owner @{user_share_dirs}/baloo/index-lock rwk,
+  owner @{user_share_dirs}/baloo/index rw,
+
+  owner @{run}/user/@{uid}/#[0-9]* rw,
+  owner @{run}/user/@{uid}/kio_desktop*kioworker.socket rwl,
+  owner @{run}/user/@{uid}/xauth_* rl,
+
+        @{PROC}/sys/kernel/core_pattern r,
+  owner @{PROC}/@{pid}/mountinfo r,
+  owner @{PROC}/@{pid}/mounts r,
+
+  /dev/tty r,
+
+  include if exists <local/kioslave5>
+}

apparmor.d/groups/kde/kscreen_backend_launcher

@@ -0,0 +1,23 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{libexec}/kf5/kscreen_backend_launcher
+profile kscreen_backend_launcher @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/qt5>
+  include <abstractions/X-strict>
+
+  @{exec_path} mr,
+
+  /usr/share/hwdata/*.ids r,
+  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+
+  /dev/tty r,
+
+  include if exists <local/kscreen_backend_launcher>
+}

apparmor.d/groups/kde/utempter

@@ -0,0 +1,20 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{libexec}/utempter/utempter
+profile utempter @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/nameservice-strict>
+  include <abstractions/wutmp>
+
+  @{exec_path} mr,
+
+  /dev/ptmx rw,
+
+  include if exists <local/utempter>
+}

apparmor.d/groups/kde/xembedsniproxy

@@ -0,0 +1,23 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/xembedsniproxy
+profile xembedsniproxy @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/nameservice-strict>
+  include <abstractions/qt5>
+
+  @{exec_path} mr,
+
+  /usr/share/hwdata/*.ids r,
+  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+
+  @{run}/user/@{uid}/xauth_* rl,
+
+  include if exists <local/xembedsniproxy>
+}

dists/flags/main.flags

@@ -89,6 +89,7 @@ dkms attach_disconnected,complain
 docker-proxy complain
 dockerd attach_disconnected,complain
 downloadhelper complain
+drkonqi complain
 e2fsck complain
 etckeeper complain
 evince complain
@@ -167,17 +168,24 @@ iwctl complain
 iwd complain
 kaccess complain
 kactivitymanagerd complain
+kalendarac complain
 kauth-backlighthelper complain
 kauth-chargethresholdhelper complain
 kauth-discretegpuhelper complain
+kauth-fontinst complain
 kauth-kded-smart-helper complain
 kauth-kinfocenter-dmidecode-helper complain
+kcminit complain
 kconf_update complain
+kde-powerdevil complain
 kded5 complain
 kernel-install complain
 kglobalaccel5 complain
 kgx complain
+kio_http_cache_cleaner complain
+kioslave5 complain
 kmod attach_disconnected,complain
+kscreen_backend_launcher complain
 ksmserver attach_disconnected,mediate_deleted,complain
 kwin_x11 complain
 landscape-sysinfo complain
@@ -317,6 +325,7 @@ umount.udisks2 complain
 update-grub complain
 update-secureboot-policy complain
 userdbctl complain
+utempter complain
 virt-manager attach_disconnected,complain
 virtinterfaced attach_disconnected,complain
 virtiofsd complain,attach_disconnected
@@ -337,5 +346,6 @@ xdg-document-portal complain
 xdg-permission-store attach_disconnected,complain
 xdg-user-dirs-gtk-update complain
 xdm-xsession complain
+xembedsniproxy complain
 xorg attach_disconnected,complain
 xsettingsd complain