Profiles update.

apparmor.d/groups/browsers/chromium-chromium

@@ -21,7 +21,7 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
   include <abstractions/gtk>
   include <abstractions/mesa>
   include <abstractions/nameservice-strict>
-  include <abstractions/opencl-intel>
+  include <abstractions/opencl>
   include <abstractions/ssl_certs>
   include <abstractions/thumbnails-cache-read>
   include <abstractions/user-download-strict>

apparmor.d/groups/bus/ibus-extension-gtk3

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}lib/ibus/ibus-extension-gtk3
 profile ibus-extension-gtk3 @{exec_path} {
   include <abstractions/base>
+  include <abstractions/dconf>
   include <abstractions/fontconfig-cache-write>
   include <abstractions/fonts>
   include <abstractions/gtk>
@@ -24,6 +25,7 @@ profile ibus-extension-gtk3 @{exec_path} {
 
   @{exec_path} mr,
 
+  /usr/share/dconf/profile/gdm r,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /usr/share/ibus/{,**} r,
   /usr/share/icons/{,**} r,
@@ -34,13 +36,12 @@ profile ibus-extension-gtk3 @{exec_path} {
   owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
   owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-[0-9] r,
 
-  include <abstractions/dconf>
+  owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* r,
+  owner @{run}/user/@{uid}/gdm/Xauthority r,
+
   owner @{run}/user/@{uid}/dconf/ rw,
   owner @{run}/user/@{uid}/dconf/user rw,
-  /usr/share/dconf/profile/gdm r,
   /var/lib/gdm/.config/dconf/user r,
 
-  owner @{run}/user/@{uid}/gdm/Xauthority r,
-
   include if exists <local/ibus-extension-gtk3>
 }

apparmor.d/groups/bus/ibus-x11

@@ -15,6 +15,7 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) {
   include <abstractions/gtk>
   include <abstractions/mesa>
   include <abstractions/nameservice-strict>
+  include <abstractions/opencl>
 
   @{exec_path} mr,
 

apparmor.d/groups/gnome/evolution-alarm-notify

@@ -12,6 +12,7 @@ profile evolution-alarm-notify @{exec_path} {
   include <abstractions/fontconfig-cache-read>
   include <abstractions/gnome>
   include <abstractions/nameservice-strict>
+  include <abstractions/opencl>
   include <abstractions/openssl>
 
   @{exec_path} mr,

apparmor.d/groups/gnome/gjs-console

@@ -57,6 +57,8 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
         @{run}/user/@{uid}/wayland-cursor-shared-* rw,
 
   @{sys}/devices/pci[0-9]*/**/drm/ r,
+  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/id r,
+  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/gt_*_mhz r,
 
   /dev/ r,
   /dev/tty rw,

apparmor.d/groups/gnome/gnome-calendar

@@ -11,6 +11,7 @@ profile gnome-calendar @{exec_path} {
   include <abstractions/base>
   include <abstractions/gnome>
   include <abstractions/nameservice-strict>
+  include <abstractions/opencl>
   include <abstractions/openssl>
   include <abstractions/p11-kit>
   include <abstractions/ssl_certs>

apparmor.d/groups/gnome/gnome-contacts-search-provider

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}lib/gnome-contacts-search-provider
 profile gnome-contacts-search-provider @{exec_path} {
   include <abstractions/base>
+  include <abstractions/opencl>
   include <abstractions/openssl>
 
   signal (send) set=(term) peer=unconfined,

apparmor.d/groups/gnome/goa-daemon

@@ -10,6 +10,7 @@ include <tunables/global>
 profile goa-daemon @{exec_path} {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
+  include <abstractions/opencl>
   include <abstractions/openssl>
   include <abstractions/p11-kit>
   include <abstractions/ssl_certs>

apparmor.d/groups/gnome/gsd-xsettings

@@ -15,6 +15,7 @@ profile gsd-xsettings @{exec_path} {
   include <abstractions/fonts>
   include <abstractions/gtk>
   include <abstractions/nameservice-strict>
+  include <abstractions/opencl>
 
   network inet stream,
   network inet6 stream,

apparmor.d/groups/gnome/nautilus

@@ -28,6 +28,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
 
   # Full access to user's data
   / r,
+  /home/ r,
   owner @{HOME}/{,**} rw,
   owner @{MOUNTS}/{,**} rw,
   owner @{run}/user/@{uid}/{,**} rw,
@@ -46,7 +47,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
 
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mountinfo r,
-  owner @{PROC}/@{pid}/net/wireless r,
+        @{PROC}/@{pids}/net/wireless r,
 
   @{run}/mount/utab r,
   @{run}/systemd/userdb/ r,

apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor

@@ -23,6 +23,8 @@ profile gvfs-udisks2-volume-monitor @{exec_path} {
 
   signal (send) set=(term, kill) peer=mount,
 
+  ptrace (read),
+
   @{exec_path} mr,
 
   /{usr/,}bin/lsof   rix,
@@ -51,10 +53,12 @@ profile gvfs-udisks2-volume-monitor @{exec_path} {
 
   owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/fdinfo/[0-9]* r,
   owner @{PROC}/@{pid}/mountinfo r,
   owner @{PROC}/@{pid}/mounts r,
-  owner @{PROC}/@{pid}/stat r,
+  owner @{PROC}/@{pid}/net/* r,
         @{PROC}/ r,
+        @{PROC}/@{pid}/stat r,
         @{PROC}/1/cgroup r,
         @{PROC}/locks r,
 

apparmor.d/groups/network/NetworkManager

@@ -13,15 +13,6 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
 
-  network inet stream,
-  network inet6 stream,
-  network inet dgram,
-  network inet6 dgram,
-  network inet raw,
-  network inet6 raw,
-  network netlink raw,
-  network packet dgram,
-
   capability audit_write,
   capability dac_override,
   capability kill,
@@ -33,6 +24,15 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
   capability sys_chroot,
   capability sys_module,
 
+  network inet stream,
+  network inet6 stream,
+  network inet dgram,
+  network inet6 dgram,
+  network inet raw,
+  network inet6 raw,
+  network netlink raw,
+  network packet dgram,
+
   @{exec_path} mr,
 
   /{usr/,}bin/{,ba,da}sh rix,

apparmor.d/groups/network/nm-dhcp-helper

@@ -10,7 +10,19 @@ include <tunables/global>
 profile nm-dhcp-helper @{exec_path} {
   include <abstractions/base>
 
+  network inet dgram,
+  network inet6 dgram,
+
+  ptrace (readby) peer=NetworkManager,
+
+  signal (receive) peer=NetworkManager,
+  signal (send) peer=dhclient,
+
   @{exec_path} mr,
 
+  /var/lib/NetworkManager/*lease r,
+
+  @{run}/NetworkManager/private-dhcp rw,
+
   include if exists <local/nm-dhcp-helper>
 }

apparmor.d/groups/network/tailscaled

@@ -42,14 +42,14 @@ profile tailscaled @{exec_path} {
   @{PROC}/ r,
   @{PROC}/@{pid}/mounts r,
   @{PROC}/@{pid}/net/{,**} r,
-  @{PROC}/sys/net/{,**} r,
   @{PROC}/@{pids}/cmdline r,
   @{PROC}/@{pids}/fd/ r,
   @{PROC}/1/cgroup r,
-  @{PROC}/1/stat r,
   @{PROC}/1/environ r,
+  @{PROC}/1/stat r,
   @{PROC}/cmdline r,
   @{PROC}/sys/kernel/osrelease r,
+  @{PROC}/sys/net/{,**} r,
 
   /dev/net/tun rw,
 

apparmor.d/groups/pacman/pacman

@@ -57,6 +57,7 @@ profile pacman @{exec_path} {
   /{usr/,}bin/gettext                     rix,
   /{usr/,}bin/ghc-pkg-*                   rix,
   /{usr/,}bin/grep                        rix,
+  /{usr/,}bin/iscsi-iname                 rix,
   /{usr/,}bin/killall                     rix,
   /{usr/,}bin/rm                          rix,
   /{usr/,}bin/setcap                      rix,

apparmor.d/groups/systemd/systemd-binfmt

@@ -17,14 +17,15 @@ profile systemd-binfmt @{exec_path} {
   @{exec_path} mr,
 
   # Config file locations
-  /etc/binfmt.d/*.conf r,
-  @{run}/binfmt.d/*.conf r,
-  /usr/lib/binfmt.d/*.conf r,
+  /etc/binfmt.d/{,*.conf} r,
+  @{run}/binfmt.d/{,*.conf} r,
+  /usr/lib/binfmt.d/{,*.conf} r,
 
   owner @{PROC}/@{pid}/stat r,
         @{PROC}/1/environ r,
         @{PROC}/cmdline r,
         @{PROC}/sys/fs/binfmt_misc/status w,
+        @{PROC}/sys/fs/binfmt_misc/register w,
         @{PROC}/sys/kernel/osrelease r,
 
   include if exists <local/systemd-binfmt>