update apparmor profiles

Signed-off-by: Alexandre Pujol <alexandre@pujol.io>

apparmor.d/groups/apps/telegram-desktop

@@ -60,6 +60,9 @@ profile telegram-desktop @{exec_path} {
   # Autostart
   owner @{user_config_dirs}/autostart/telegramdesktop.desktop rw,
 
+  owner /tmp/[0-9a-f]*-* rwk,
+  owner @{run}/user/@{uid}/[0-9a-f]*-* rwk,
+
   /dev/shm/#[0-9]*[0-9] rw,
 
        owner @{PROC}/@{pid}/fd/ r,

apparmor.d/groups/apt/dpkg-genchanges

@@ -20,7 +20,7 @@ profile dpkg-genchanges @{exec_path} flags=(complain) {
   /usr/share/dpkg/tupletable r,
 
   # For package building
-  owner @{user_build_dirs}/** r,
+  owner @{user_build_dirs}/** rw,
 
   include if exists <local/dpkg-genchanges>
 }

apparmor.d/groups/browsers/chromium-chromium

@@ -52,8 +52,9 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mrix,
 
-  @{CHROMIUM_INSTALLDIR}/chrome-sandbox rPx,
-  /{usr/,}bin/chrome-gnome-shell        rPx,
+  /{usr/,}bin/chrome-gnome-shell          rPx,
+  @{CHROMIUM_INSTALLDIR}/chrome-sandbox   rPx,
+  @{CHROMIUM_INSTALLDIR}/crashpad_handler rPx,
 
   # For storing passwords externally
   /{usr/,}bin/keepassxc-proxy   rPUx,

apparmor.d/groups/browsers/chromium-crashpad-handler

@@ -0,0 +1,26 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{CHROMIUM_INSTALLDIR} = /{usr/,}lib/chromium
+@{CHROMIUM_HOMEDIR} = @{HOME}/.config/chromium
+@{CHROMIUM_CACHEDIR} = @{HOME}/.cache/chromium
+
+@{exec_path} = /{usr/,}lib/chromium/crashpad_handler
+
+profile chromium-crashpad_handler @{exec_path} flags=(complain) {
+  include <abstractions/base>
+  include <abstractions/deny-root-dir-access>
+
+  @{exec_path} mrix,
+
+  owner "@{HOME}/.config/chromium/Crash Reports/settings.dat" rwk,
+
+  owner @{PROC}/@{pid}/fd/ r,
+
+  include if exists <local/chromium-crashpad_handler>
+}