update apparmor profiles

Signed-off-by: Alexandre Pujol <alexandre@pujol.io>

apparmor.d/profiles-s-z/sudo

@@ -32,6 +32,7 @@ profile sudo @{exec_path} {
   signal,
 
   @{exec_path} mr,
+  @{libexec}/sudo/** mr,
 
   # Shells to use
   /{usr/,}bin/{,b,d,rb}ash rpux,
@@ -58,6 +59,7 @@ profile sudo @{exec_path} {
 
   @{PROC}/@{pid}/fd/ r,
   @{PROC}/@{pids}/stat r,
+  @{PROC}/1/limits r,
 
   # File Inherit
   owner /dev/tty[0-9]* rw,

apparmor.d/profiles-s-z/syncthing

@@ -28,6 +28,7 @@ profile syncthing @{exec_path} {
   /usr/share/mime/{,*} r,
 
   /etc/mime.types r,
+  /usr/share/mime/globs2 r,
 
   owner @{user_config_dirs}/syncthing/{,**} rwk,
   owner @{HOME}/@{XDG_DATA_HOME}/syncthing/{,**} rwk,

apparmor.d/profiles-s-z/transmission-qt

@@ -0,0 +1,67 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{TORRENT_DIR} = /media/*/torrent
+
+@{exec_path} = /{usr/,}bin/transmission-qt
+profile transmission-qt @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/gtk>
+  include <abstractions/fonts>
+  include <abstractions/fontconfig-cache-read>
+  include <abstractions/freedesktop.org>
+  include <abstractions/user-download-strict>
+  include <abstractions/private-files-strict>
+  include <abstractions/dri-common>
+  include <abstractions/dri-enumerate>
+  include <abstractions/qt5>
+  include <abstractions/qt5-settings-write>
+  include <abstractions/mesa>
+  include <abstractions/nameservice-strict>
+  include <abstractions/openssl>
+  include <abstractions/ssl_certs>
+  include <abstractions/deny-root-dir-access>
+
+  network inet dgram,
+  network inet6 dgram,
+  network inet stream,
+  network inet6 stream,
+  network netlink dgram,
+  network netlink raw,
+
+  @{exec_path} mr,
+
+  # Torrent files
+        /media/ r,
+  owner /media/*/ r,
+  owner @{TORRENT_DIR}/ r,
+  owner @{TORRENT_DIR}/** rw,
+
+  owner @{HOME}/.config/transmission/ rw,
+  owner @{HOME}/.config/transmission/** rwk,
+
+  owner @{HOME}/.cache/ rw,
+  owner @{HOME}/.cache/transmission/ rw,
+  owner @{HOME}/.cache/transmission/** rwk,
+
+  owner /tmp/tr_session_id_* rwk,
+
+  deny owner @{PROC}/@{pid}/cmdline r,
+       owner @{PROC}/@{pid}/mountinfo r,
+       owner @{PROC}/@{pid}/mounts r,
+             @{PROC}/@{pid}/net/route r,
+             @{PROC}/sys/kernel/random/uuid r,
+
+  # To configure Qt5 settings (theme, font, icons, etc.) under DE/WM without Qt integration
+  owner @{HOME}/.config/qt5ct/{,**} r,
+  /usr/share/qt5ct/** r,
+
+  /usr/share/hwdata/pnp.ids r,
+
+  include if exists <local/transmission-qt>
+}

apparmor.d/profiles-s-z/yt-dlp

@@ -0,0 +1,73 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+# Video/audio extensions:
+# a52, aac, ac3, mka, flac, mp1, mp2, mp3, mpc, oga, oma, wav, wv, wm, wma, 3g2, 3gp, 3gp2, 3gpp,
+# asf, avi, divx, m1v, m2v, m4v, mkv, mov, mp4, mpa, mpe, mpg, mpeg, mpeg1, mpeg2, mpeg4, ogg, ogm,
+# ogx, ogv, rm, rmvb, webm, wmv, wtv, mp2t, m4a
+@{ytdlp_ext}  = [aA]{52,[aA][cC],[cC]3}
+@{ytdlp_ext} += [mM][kK][aA]
+@{ytdlp_ext} += [fF][lL][aA][cC]
+@{ytdlp_ext} += [mM][pP][123cC]
+@{ytdlp_ext} += [oO][gGmM][aA]
+@{ytdlp_ext} += [wW]{,[aA]}[vV]
+@{ytdlp_ext} += [wW][mM]{,[aA]}
+@{ytdlp_ext} += 3[gG]{[2pP],[pP][2pP]}
+@{ytdlp_ext} += [aA][sS][fF]
+@{ytdlp_ext} += [aA][vV][iI]
+@{ytdlp_ext} += [dD][iI][vV][xX]
+@{ytdlp_ext} += [mM][124][vV]
+@{ytdlp_ext} += [mM][kKoO][vV]
+@{ytdlp_ext} += [mM][pP][4aAeEgG]
+@{ytdlp_ext} += [mM][pP][eE][gG]{,[124]}
+@{ytdlp_ext} += [oO][gG][gGmMxXvV]
+@{ytdlp_ext} += [rR][mM]{,[vV][bB]}
+@{ytdlp_ext} += [wW][eE][bB][mM]
+@{ytdlp_ext} += [wW][mMtT][vV]
+@{ytdlp_ext} += [mM][pP]2[tT]
+@{ytdlp_ext} += [mM]4[aA]
+
+# The ytdl specific file extensions
+# ytdl, part, tmp, temp
+@{ytdlp_ext} += [yY][tT][dD][lL]
+@{ytdlp_ext} += part{,-*}
+@{ytdlp_ext} += [tT]{,[eE]}[mM][pP]
+
+@{exec_path} = /{usr/,}bin/yt-dlp
+profile yt-dlp @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/python>
+  include <abstractions/nameservice-strict>
+  include <abstractions/openssl>
+  include <abstractions/ssl_certs>
+  include <abstractions/user-download-strict>
+  include <abstractions/deny-root-dir-access>
+
+  network inet dgram,
+  network inet6 dgram,
+  network inet stream,
+  network inet6 stream,
+  network netlink raw,
+
+  @{exec_path} r,
+  /{usr/,}bin/python3.[0-9]* r,
+
+  /{usr/,}bin/ r,
+  /{usr/,}bin/file rix,
+
+  # Which files yt-dlp should be able to open
+  owner /media/**/ r,
+  owner /media/**.@{ytdlp_ext} rw,
+
+  owner @{PROC}/@{pid}/fd/ r,
+
+  /etc/magic r,
+
+
+  include if exists <local/yt-dlp>
+}