feat(profile): general update.

apparmor.d/profiles-m-r/mount-nfs

@@ -25,31 +25,6 @@ profile mount-nfs @{exec_path} flags=(complain) {
   network inet stream,
   network inet6 stream,
 
-  @{exec_path} mr,
-
-  @{bin}/{,ba,da}sh       rix,
-  @{bin}/flock            rix,
-  @{bin}/start-statd      rix,
-
-  /usr/bin/systemctl           rPx -> child-systemctl,
-
-  /etc/fstab r,
-  /etc/netconfig r,
-  /etc/rpc r,
-
-        @{PROC}/filesystems r,
-  owner @{PROC}/@{pid}/mountinfo r,
-
-  owner @{run}/mount/utab{,.*} rw,
-  owner @{run}/mount/utab.lock wk,
-
-  owner @{run}/rpc.statd.lock wk,
-
-  # Mount points
-  @{MOUNTDIRS}/ r,
-  @{MOUNTS}/ r,
-  @{MOUNTS}/*/ r,
-
   # Allow to mount smb/cifs disks only under the /media/ dirs
   mount fstype=nfs -> @{MOUNTDIRS}/,
   mount fstype=nfs -> @{MOUNTS}/,
@@ -63,5 +38,30 @@ profile mount-nfs @{exec_path} flags=(complain) {
   umount /,
   umount /*/,
 
+  @{exec_path} mr,
+
+  @{bin}/{,ba,da}sh       rix,
+  @{bin}/flock            rix,
+  @{bin}/start-statd      rix,
+
+  /usr/bin/systemctl           rPx -> child-systemctl,
+
+  /etc/fstab r,
+  /etc/netconfig r,
+  /etc/nfsmount.conf rk,
+  /etc/rpc r,
+
+  # Mount points
+  @{MOUNTDIRS}/ r,
+  @{MOUNTS}/ r,
+  @{MOUNTS}/*/ r,
+
+  owner @{run}/mount/utab.lock wk,
+  owner @{run}/mount/utab{,.*} rw,
+  owner @{run}/rpc.statd.lock wk,
+
+        @{PROC}/filesystems r,
+  owner @{PROC}/@{pid}/mountinfo r,
+
   include if exists <local/mount-nfs>
 }

apparmor.d/profiles-m-r/nvtop

@@ -40,6 +40,7 @@ profile nvtop @{exec_path} flags=(attach_disconnected) {
   @{PROC}/@{pids}/fdinfo/ r,
   @{PROC}/@{pids}/fdinfo/@{int} r,
   @{PROC}/@{pids}/stat r,
+  @{PROC}/devices r,
   @{PROC}/driver/nvidia/capabilities/mig/{config,monitor}  r,
 
   /dev/dri/ r,

apparmor.d/profiles-m-r/pinentry-gnome3

@@ -10,6 +10,8 @@ include <tunables/global>
 profile pinentry-gnome3 @{exec_path} {
   include <abstractions/base>
 
+  signal (receive) set=(int) peer=gpg-agent,
+
   @{exec_path} mr,
 
   owner @{PROC}/@{pid}/cmdline r,

apparmor.d/profiles-m-r/protonmail-bridge

@@ -37,6 +37,13 @@ profile protonmail-bridge @{exec_path}  {
   @{PROC}/sys/net/core/somaxconn r,
   @{PROC}/@{pid}/cgroup r,
 
+  # Force the use of the Gnome Keyring or Kwallet secret-service.
+  # Comment these lines and add the commented lines in your local/protonmail-bridge
+  # to allow the use of pass as secret-service.
+  # of pass as secret store
+  # deny @{bin}/pass rmx,
+  # deny owner @{user_password_store_dirs}/** r,
+
   profile pass {
     include <abstractions/base>
     include <abstractions/nameservice-strict>