feat(profile): general update.

apparmor.d/groups/browsers/firefox-glxtest

@@ -9,6 +9,7 @@ include <tunables/global>
 @{name} = firefox{,.sh,-esr,-bin}
 @{lib_dirs} = @{lib}/@{name} /opt/@{name}
 @{config_dirs} = @{HOME}/.mozilla/
+@{cache_dirs} = @{user_cache_dirs}/mozilla/
 
 @{exec_path} = @{lib_dirs}/glxtest
 profile firefox-glxtest @{exec_path} flags=(attach_disconnected) {
@@ -19,6 +20,9 @@ profile firefox-glxtest @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
+  owner @{cache_dirs}/firefox/*/startupCache/scriptCache-* r,
+  owner @{cache_dirs}/firefox/*/startupCache/startupCache* r,
+
   owner @{config_dirs}/firefox/*/.parentlock rw,
 
   owner @{tmp}/@{name}/.parentlock rw,

apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome

@@ -71,6 +71,7 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) {
   owner @{desktop_cache_dirs}/fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} rw,
 
   owner @{HOME}/ r,
+  owner @{HOME}/* r,
   owner @{HOME}/*/{,**} rw,
   owner @{MOUNTS}/ r,
 

apparmor.d/groups/gnome/gnome-clocks

@@ -14,8 +14,11 @@ profile gnome-clocks @{exec_path} {
   include <abstractions/bus-session>
   include <abstractions/bus/org.a11y>
   include <abstractions/common/gnome>
+  include <abstractions/gstreamer>
   include <abstractions/nameservice-strict>
 
+  network netlink raw,
+
   #aa:dbus own bus=session name=org.gnome.clocks
 
   @{exec_path} mr,

apparmor.d/groups/gnome/gnome-software

@@ -83,6 +83,11 @@ profile gnome-software @{exec_path} {
 
   owner @{user_share_dirs}/ r,
   owner @{user_share_dirs}/flatpak/.changed w,
+  owner @{user_share_dirs}/flatpak/{app,runtime}/ r,
+  owner @{user_share_dirs}/flatpak/{app,runtime}/*/ r,
+  owner @{user_share_dirs}/flatpak/{app,runtime}/*/**/@{hex64}/deploy r,
+  owner @{user_share_dirs}/flatpak/{app,runtime}/*/**/@{hex64}/metadata r,
+  owner @{user_share_dirs}/flatpak/{app,runtime}/*/*/ r,
   owner @{user_share_dirs}/flatpak/repo/ rw,
   owner @{user_share_dirs}/flatpak/repo/** rwl -> @{user_share_dirs}/flatpak/repo/**,
   owner @{user_share_dirs}/gnome-software/{,**} rw,

apparmor.d/groups/gnome/gnome-system-monitor

@@ -38,6 +38,8 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
   /usr/share/gnome-system-monitor/{,**} r,
   /usr/share/firefox-esr/browser/chrome/icons/default/*.png r,
 
+  owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw,
+
   owner @{run}/user/@{uid}/doc/ rw,
   owner @{run}/user/@{uid}/gnome-shell-disable-extensions w,
 

apparmor.d/groups/gnome/gnome-tweaks

@@ -16,6 +16,8 @@ profile gnome-tweaks @{exec_path} {
   include <abstractions/python>
   include <abstractions/thumbnails-cache-read>
 
+  network netlink raw,
+
   @{exec_path} mr,
 
   @{bin}/ r,

apparmor.d/groups/gnome/gsd-datetime

@@ -34,6 +34,7 @@ profile gsd-datetime @{exec_path} flags=(attach_disconnected) {
 
   owner @{user_cache_dirs}/geocode-glib/* r,
 
+  owner @{PROC}/@{pid}/fdinfo/@{int} r,
   owner @{PROC}/@{pid}/stat r,
 
   owner /dev/tty@{int} rw,

apparmor.d/groups/gnome/org.gnome.NautilusPreviewer

@@ -47,6 +47,7 @@ profile org.gnome.NautilusPreviewer @{exec_path} {
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/mounts r,
   owner @{PROC}/@{pid}/stat r,
+  owner @{PROC}/@{pid}/task/@{tid}/comm w,
   owner @{PROC}/@{pid}/task/@{tid}/stat r,
 
   /dev/media@{int} r,

apparmor.d/groups/gnome/tracker-miner

@@ -65,7 +65,9 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
   owner @{gdm_config_dirs}/dconf/user r,
   owner @{gdm_share_dirs}/applications/ r,
 
+  owner /var/tmp/etilqs_@{hex15} rw,
   owner /var/tmp/etilqs_@{hex16} rw,
+  owner @{tmp}/etilqs_@{hex15} rw,
   owner @{tmp}/etilqs_@{hex16} rw,
 
   # Allow to search user files

apparmor.d/groups/gvfs/gvfsd-mtp

@@ -21,7 +21,7 @@ profile gvfsd-mtp @{exec_path} {
 
   @{exec_path} mr,
 
-  owner @{HOME}/{,**} rw,
+  owner @{HOME}/{,**} rw, # FIXME: ?
   owner @{MOUNTS}/{,**} rw,
 
   owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw,

apparmor.d/groups/gvfs/gvfsd-recent

@@ -36,7 +36,7 @@ profile gvfsd-recent @{exec_path} {
   @{exec_path} mr,
 
   # Full access to user's data
-  owner @{HOME}/{,**} rw,
+  owner @{HOME}/{,**} rw, # FIXME: ?
   owner @{MOUNTS}/{,**} rw,
 
   owner @{HOME}/.zshenv r,

apparmor.d/groups/pacman/pacman

@@ -118,6 +118,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) {
   /var/** rwlk -> /var/**,
 
   # Read packages files
+  @{user_pkg_dirs}/ r,
   @{user_pkg_dirs}/**/ r,
   @{user_pkg_dirs}/**.pkg.tar.zst{,.sig} r,
 
@@ -193,6 +194,8 @@ profile pacman @{exec_path} flags=(attach_disconnected) {
     capability dac_read_search,
     capability sys_resource,
 
+    signal send set=cont peer=child-pager,
+
     @{bin}/pager       rPx -> child-pager,
     @{bin}/less        rPx -> child-pager,
     @{bin}/more        rPx -> child-pager,

apparmor.d/groups/virt/libvirtd

@@ -131,6 +131,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
 
   /usr/share/edk2*/{,**} rk,
   /usr/share/hwdata/* r,
+  /usr/share/iproute2/{,**} r,
   /usr/share/libvirt/{,**} r,
   /usr/share/mime/mime.cache r,
   /usr/share/misc/pci.ids r,

apparmor.d/groups/virt/virtnodedevd

@@ -62,6 +62,7 @@ profile virtnodedevd @{exec_path} flags=(attach_disconnected) {
   @{run}/udev/data/c21:@{int} r,          # Generic SCSI access
   @{run}/udev/data/c29:@{int} r,          # For /dev/fb[0-9]*
   @{run}/udev/data/c81:@{int}  r,         # For video4linux
+  @{run}/udev/data/c89:@{int}  r,         # For I2C bus interface
   @{run}/udev/data/c90:@{int} r,          # For RAM, ROM, Flash
   @{run}/udev/data/c116:@{int} r,         # For ALSA
   @{run}/udev/data/c202:@{int} r,         # CPU model-specific registers

apparmor.d/groups/xfce/xfce-sensors

@@ -16,7 +16,7 @@ profile xfce-sensors @{exec_path} {
   @{sys}/class/hwmon/ r,
   @{sys}/class/power_supply/ r,
   @{sys}/class/thermal/ r,
-  @{sys}/devices/@{pci}/i2c-@{int}/name r,
+  @{sys}/devices/@{pci}/i2c-@{int}/{,**/}name r,
   @{sys}/devices/**/hwmon@{int}/ r,
   @{sys}/devices/**/hwmon@{int}/{name,temp*} r,
   @{sys}/devices/**/hwmon@{int}/**/ r,