Profile update.

apparmor.d/groups/browsers/chromium-chromium

@@ -200,6 +200,7 @@ profile chromium-chromium @{exec_path} {
   profile open {
     include <abstractions/base>
     include <abstractions/xdg-open>
+    include <abstractions/app-launcher-user>
 
     /{usr/,}bin/xdg-open mr,
 

apparmor.d/groups/desktop/dconf-service

@@ -7,12 +7,14 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}lib/dconf/dconf-service /usr/{lib,libexec}/dconf-service
-profile dconf-service @{exec_path} {
+profile dconf-service @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
 
   # Needed?
   deny capability sys_nice,
 
+  signal (receive) set=term peer=gdm,
+
   @{exec_path} mr,
 
   owner @{run}/user/@{uid}/dconf/ rw,
@@ -24,8 +26,11 @@ profile dconf-service @{exec_path} {
   owner @{user_cache_dirs}/ rw,
   owner @{user_cache_dirs}/dconf/ rw,
   owner @{user_cache_dirs}/dconf/user rw,
+  /var/lib/gdm/.config/dconf/user r,
 
   @{PROC}/cmdline r,
 
+  /dev/tty[0-9]* rw,
+
   include if exists <local/dconf-service>
 }

apparmor.d/groups/gnome/gnome-session-binary

@@ -16,7 +16,6 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
 
   signal (send) set=(term) peer=gsd-*,
   signal (receive) set=(term, hup) peer=gdm*,
-  signal (receive) set=(term) peer=gdm-wayland-session,
 
   @{exec_path} mr,
 

apparmor.d/groups/gnome/gnome-shell

@@ -33,6 +33,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   signal (receive) set=(term, hup) peer=gdm*,
   signal (send) set=(usr1) peer=ibus-daemon,
   signal (send) set=(term) peer=polkit*,
+  signal (send) set=(term) peer=xwayland,
 
   @{exec_path} mr,
 
@@ -126,7 +127,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   @{sys}/devices/pci[0-9]*/**/boot_vga r,
   @{sys}/devices/pci[0-9]*/**/input[0-9]*/{properties,name} r,
   @{sys}/devices/pci[0-9]*/**/net/*/statistics/{rx_bytes,tx_bytes} r,
-  @{sys}/devices/pci[0-9]*/drm/ r,
+  @{sys}/devices/pci[0-9]*/**/drm/ r,
 
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/cgroup r,

apparmor.d/groups/gnome/gnome-shell-hotplug-sniffer

@@ -12,5 +12,7 @@ profile gnome-shell-hotplug-sniffer @{exec_path} {
 
   @{exec_path} mr,
 
+  /usr/share/mime/mime.cache r,
+
   include if exists <local/gnome-shell-hotplug-sniffer>
 }

apparmor.d/groups/gnome/gsd-housekeeping

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}lib/gsd-housekeeping
 profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/app-launcher-user>
   include <abstractions/thumbnails-cache-read>
 
   signal (receive) set=(term, hup) peer=gdm*,

apparmor.d/groups/gpg/gpg-agent

@@ -17,6 +17,7 @@ profile gpg-agent @{exec_path} {
   @{exec_path} mr,
 
   /{usr/,}lib/gnupg/scdaemon rPx,
+  /{usr/,}bin/pinentry-*     rPx,
 
   /usr/share/gnupg/* r,
 
@@ -47,9 +48,6 @@ profile gpg-agent @{exec_path} {
 
   @{PROC}/@{pid}/fd/ r,
 
-  # PIN-entry apps
-  /{usr/,}bin/pinentry-* rPx,
-
   # file_inherit
   owner @{HOME}/.xsession-errors w,
 

apparmor.d/groups/gpg/gpgconf

@@ -24,6 +24,7 @@ profile gpgconf @{exec_path} {
   /{usr/,}bin/pinentry-*        rPx,
 
   owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
+  owner @{HOME}/@{XDG_PROJECTS_DIR}/**/gnupg/** rwkl -> @{HOME}/@{XDG_PROJECTS_DIR}/**/gnupg/**,
 
   owner @{PROC}/@{pid}/task/@{tid}/stat rw,
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,

apparmor.d/groups/gpg/gpgsm

@@ -16,6 +16,7 @@ profile gpgsm @{exec_path} {
   deny /usr/bin/.gnupg/ w,
 
   owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
+  owner @{HOME}/@{XDG_PROJECTS_DIR}/**/gnupg/** rwkl -> @{HOME}/@{XDG_PROJECTS_DIR}/**,
 
   owner /var/lib/*/.gnupg/** rwkl -> /var/lib/*/.gnupg/**,