feat(opensuse): desktop integration.

apparmor.d/groups/network/ModemManager

@@ -12,6 +12,7 @@ profile ModemManager @{exec_path} flags=(attach_disconnected) {
   include <abstractions/consoles>
   include <abstractions/dbus-strict>
 
+  network qipcrtr dgram,
   network netlink raw,
 
   dbus send bus=system path=/org/freedesktop/DBus

apparmor.d/groups/network/NetworkManager

@@ -119,18 +119,19 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
 
   @{sys}/bus/ r,
   @{sys}/class/ r,
-  @{sys}/class/rfkill/ r,
   @{sys}/class/net/ r,
   @{sys}/class/net/rfkill/ r,
+  @{sys}/class/rfkill/ r,
 
   @{run}/network/ifstate r,
   @{run}/NetworkManager/{,**} rw,
+  @{run}/nscd/db* rwl,
   @{run}/systemd/inhibit/[0-9]*.ref rw,
   @{run}/systemd/users/@{uid} r,
-  @{run}/udev/data/n[0-9]* r,
-  @{run}/udev/data/+rfkill:* r,
-  @{run}/udev/data/+platform* r,
   @{run}/udev/data/+pci* r,
+  @{run}/udev/data/+platform* r,
+  @{run}/udev/data/+rfkill:* r,
+  @{run}/udev/data/n[0-9]* r,
 
   @{sys}/devices/**/uevent r,
   @{sys}/devices/virtual/net/{,**} r,

apparmor.d/groups/network/nm-daemon-helper

@@ -0,0 +1,20 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{libexec}/nm-daemon-helper
+profile nm-daemon-helper @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/nameservice-strict>
+
+  network inet dgram,
+  network inet6 dgram,
+
+  @{exec_path} mr,
+
+  include if exists <local/nm-daemon-helper>
+}

apparmor.d/groups/network/nm-dispatcher

@@ -27,24 +27,37 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
   @{exec_path} mr,
 
   /{usr/,}bin/{,ba,da}sh         rix,
+  /{usr/,}bin/basename           rix,
+  /{usr/,}bin/chronyc           rPUx,
   /{usr/,}bin/date               rix,
   /{usr/,}bin/gawk               rix,
   /{usr/,}bin/grep               rix,
   /{usr/,}bin/id                 rix,
+  /{usr/,}bin/mkdir              rix,
   /{usr/,}bin/mktemp             rix,
   /{usr/,}bin/nmcli              rix,
   /{usr/,}bin/readlink           rix,
   /{usr/,}bin/rm                 rix,
   /{usr/,}bin/run-parts          rPx,
+  /{usr/,}bin/sed                rix,
+  /{usr/,}bin/systemctl          rPx -> child-systemctl,
+  /{usr/,}bin/systemd-cat        rPx,
+  /{usr/,}bin/tr                 rix,
   /usr/share/tlp/tlp-readconfs  rPUx,
 
-  /usr/share/tlp/{,**} rw,
-
+  /{usr/,}lib/NetworkManager/dispatcher.d/ r,
+  /{usr/,}lib/NetworkManager/dispatcher.d/* rix,
   /etc/NetworkManager/dispatcher.d/ r,
   /etc/NetworkManager/dispatcher.d/** rix,
 
+  /usr/share/tlp/{,**} rw,
+
+  /etc/sysconfig/network/config r,
+  /etc/fstab r,
+
   @{run}/systemd/notify rw,
   @{run}/tlp/{,*} rw,
+  @{run}/chrony-dhcp/ rw,
 
   owner @{PROC}/@{pid}/fd/ r,