diff --git a/apparmor.d/groups/gpg/gpg-agent b/apparmor.d/groups/gpg/gpg-agent index 04bf1429d..e77302fcc 100644 --- a/apparmor.d/groups/gpg/gpg-agent +++ b/apparmor.d/groups/gpg/gpg-agent @@ -12,6 +12,7 @@ profile gpg-agent @{exec_path} { include signal (receive) peer=pinentry-*, + signal (receive) peer=scdaemon, @{exec_path} mr, @@ -23,16 +24,17 @@ profile gpg-agent @{exec_path} { owner @{HOME}/@{XDG_GPG_DIR}/gpg-agent.conf r, owner @{HOME}/@{XDG_GPG_DIR}/private-keys-v1.d/ rw, owner @{HOME}/@{XDG_GPG_DIR}/private-keys-v1.d/[0-9A-F]*.key rw, + owner @{HOME}/@{XDG_GPG_DIR}/S.gpg-agent{,.ssh,.browser,.extra} rw, owner /var/lib/*/.gnupg/ rw, owner /var/lib/*/.gnupg/private-keys-v1.d/ rw, owner /var/lib/*/.gnupg/private-keys-v1.d/[0-9A-F]*.key rw, - owner /var/lib/*/.gnupg/S.gpg-agent rw, + owner /var/lib/*/.gnupg/S.gpg-agent{,.ssh,.browser,.extra} rw, owner /var/lib/*/gnupg/ rw, owner /var/lib/*/gnupg/private-keys-v1.d/ rw, owner /var/lib/*/gnupg/private-keys-v1.d/[0-9A-F]*.key rw, - owner /var/lib/*/gnupg/S.gpg-agent rw, + owner /var/lib/*/gnupg/S.gpg-agent{,.ssh,.browser,.extra} rw, # For debuild owner /tmp/dpkg-import-key.*/private-keys-v1.d/ w, diff --git a/apparmor.d/groups/gpg/scdaemon b/apparmor.d/groups/gpg/scdaemon index dff35cb2d..12d85ad9f 100644 --- a/apparmor.d/groups/gpg/scdaemon +++ b/apparmor.d/groups/gpg/scdaemon @@ -13,9 +13,12 @@ profile scdaemon @{exec_path} { network netlink raw, + signal (send) peer=gpg-agent, + @{exec_path} mr, owner @{HOME}/@{XDG_GPG_DIR}/scdaemon.conf r, + owner @{HOME}/@{XDG_GPG_DIR}/reader_0.status rw, owner @{run}/user/[0-9]*/gnupg/S.scdaemon rw,