feat(profiles): general update.

apparmor.d/groups/freedesktop/plymouth-set-default-theme

@@ -9,13 +9,14 @@ include <tunables/global>
 @{exec_path} = @{bin}/plymouth-set-default-theme
 profile plymouth-set-default-theme @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/nameservice-strict>
 
   @{exec_path} mr,
 
+  @{bin}/{,ba,da}sh  rix,
   @{bin}/{m,g,}awk   rix,
   @{bin}/grep        rix,
   @{bin}/plymouth    rPx,
-  @{bin}/{,ba,da}sh  rix,
 
   /etc/plymouth/{,*} r,
 

apparmor.d/groups/freedesktop/polkit-kde-authentication-agent

@@ -50,9 +50,13 @@ profile polkit-kde-authentication-agent @{exec_path} {
 
   owner /tmp/#@{int} rw,
   owner /tmp/polkit-kde-authentication-agent-[0-9].* rwl -> /tmp/#@{int},
+  owner /tmp/xauth_@{rand6} r,
 
   @{run}/systemd/users/@{uid} r,
 
+  @{sys}/devices/system/node/ r,
+  @{sys}/devices/system/node/node@{int}/meminfo r,
+
   @{PROC}/@{pid}/cgroup r,
   @{PROC}/@{pid}/cmdline r,
   @{PROC}/@{pid}/fd/ r,

apparmor.d/groups/freedesktop/xorg

@@ -1,6 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2017-2021 Mikhail Morfikov
-# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
+# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,

apparmor.d/groups/freedesktop/xrdb

@@ -12,6 +12,8 @@ profile xrdb @{exec_path} {
   include <abstractions/base>
   include <abstractions/X-strict>
 
+  capability dac_read_search,
+
   @{exec_path} mr,
 
   @{bin}/{,*-}cpp-[0-9]*               rix,

apparmor.d/groups/freedesktop/xsetroot

@@ -19,10 +19,14 @@ profile xsetroot @{exec_path} {
 
   /etc/X11/cursors/*.theme r,
 
+  owner @{HOME}/.icons/** r,
   owner @{HOME}/.Xauthority r,
   owner @{HOME}/.xsession-errors w,
+
   owner @{user_share_dirs}/sddm/xorg-session.log w,
 
+  owner /tmp/xauth_@{rand6} r,
+
   @{run}/sddm/\{@{uuid}\} r,
   @{run}/user/@{uid}/xauth_@{rand6} rl,
   @{run}/sddm/xauth_@{rand6} r,

apparmor.d/groups/freedesktop/xwayland

@@ -15,13 +15,13 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
   include <abstractions/nameservice-strict>
   include <abstractions/opencl>
   include <abstractions/vulkan>
+  include <abstractions/X-strict>
 
   signal (receive) set=(term hup) peer=gdm*,
   signal (receive) set=(term hup) peer=gnome-shell,
   signal (receive) set=(term hup) peer=kwin_wayland,
   signal (receive) set=(term hup) peer=login,
 
-  unix (send,receive) type=stream addr="@/tmp/.X11-unix/X[0-9]*",
   unix (send,receive) type=stream addr=none peer=(label=gnome-shell),
 
   @{exec_path} mrix,
@@ -33,7 +33,6 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
   /usr/share/fonts/{,**} r,
   /usr/share/ghostscript/fonts/{,**} r,
   /usr/share/libdrm/*.ids r,
-  /usr/share/X11/xkb/rules/evdev r,
 
   owner /var/lib/gdm{3,}/.cache/mesa_shader_cache/index rw,