feat(profiles): general update.

apparmor.d/profiles-m-r/multipath

@@ -24,8 +24,6 @@ profile multipath @{exec_path} {
 
   @{sys}/bus/ r,
   @{sys}/class/ r,
-  @{sys}/devices/pci[0-9]*/**/ata[0-9]*/host[0-9]*/ r,
-  @{sys}/devices/pci[0-9]*/**/ata[0-9]*/host[0-9]*/** r,
 
   @{PROC}/devices r,
   @{PROC}/sys/fs/nr_open r,

apparmor.d/profiles-m-r/packagekitd

@@ -99,12 +99,12 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
   @{bin}/touch          rix,
 
   @{bin}/appstreamcli                rPx,
-  @{bin}/arch-audit                  rPx,
-  @{bin}/dpkg                        rPx -> child-dpkg,
+  @{bin}/arch-audit                  rPx, # only: arch
+  @{bin}/dpkg                        rPx -> child-dpkg, # only: dpkg
   @{bin}/glib-compile-schemas        rPx,
   @{bin}/systemd-inhibit             rPx,
   @{bin}/update-desktop-database     rPx,
-  @{lib}/apt/methods/*               rPx,
+  @{lib}/apt/methods/*               rPx, # only: dpkg
   @{lib}/cnf-update-db               rPx,
   @{lib}/update-notifier/update-motd-updates-available  rPx,
   @{lib}/zypp/plugins/appdata/InstallAppdata rPUx, # TODO: write the profile
@@ -126,6 +126,7 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
         @{run}/zypp.pid rwk, # only: opensuse
   owner @{run}/systemd/users/@{uid} r,
   owner @{run}/zypp-rpm.pid rwk, # only: opensuse
+  owner @{run}/zypp/packages/ r, # only: opensuse
 
   owner /dev/shm/AP_0x@{rand6}/{,**} rw,
   owner /dev/shm/ r,

apparmor.d/profiles-m-r/pinentry-qt

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2018-2021 Mikhail Morfikov
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -9,32 +10,43 @@ include <tunables/global>
 @{exec_path} = @{bin}/pinentry-qt
 profile pinentry-qt @{exec_path} {
   include <abstractions/base>
-  include <abstractions/X>
-  include <abstractions/gtk>
-  include <abstractions/fonts>
-  include <abstractions/fontconfig-cache-read>
-  include <abstractions/freedesktop.org>
   include <abstractions/dri-enumerate>
+  include <abstractions/fontconfig-cache-read>
+  include <abstractions/fonts>
+  include <abstractions/freedesktop.org>
+  include <abstractions/gtk>
   include <abstractions/mesa>
   include <abstractions/nameservice-strict>
   include <abstractions/qt5-compose-cache-write>
+  include <abstractions/qt5>
+  include <abstractions/vulkan>
+  include <abstractions/X>
 
   @{exec_path} mr,
 
-  owner @{PROC}/@{pid}/cmdline r,
-
-  # To configure Qt5 settings (theme, font, icons, etc.) under DE/WM without Qt integration
-  owner @{user_config_dirs}/qt5ct/{,**} r,
+  /usr/share/hwdata/pnp.ids r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
   /usr/share/qt5ct/** r,
 
-  owner @{user_cache_dirs}/#@{int} rw,
-
   /var/lib/dbus/machine-id r,
   /etc/machine-id r,
+  /etc/xdg/kdeglobals r,
+  /etc/xdg/kwinrc r,
 
-  /dev/shm/#@{int} rw,
+  owner @{user_cache_dirs}/#@{int} rw,
+  owner @{user_cache_dirs}/icon-cache.kcache rw,
 
-  /usr/share/hwdata/pnp.ids r,
+  owner @{user_config_dirs}/kdeglobals r,
+  owner @{user_config_dirs}/kwinrc r,
+  owner @{user_config_dirs}/qt5ct/{,**} r,
+
+  owner /tmp/xauth_@{rand6} r,
+  owner /dev/shm/#@{int} rw,
+
+  @{sys}/devices/system/node/ r,
+  @{sys}/devices/system/node/node@{int}/meminfo r,
+
+  owner @{PROC}/@{pid}/cmdline r,
 
   include if exists <local/pinentry-qt>
 }