Add gdm profiles.

apparmor.d/groups/gnome/gdm-session-worker

@@ -0,0 +1,63 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}lib/gdm-session-worker
+profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+  include <abstractions/authentication>
+  include <abstractions/nameservice-strict>
+
+  signal (send) set=term peer=gdm-wayland-session,
+
+  capability audit_write,
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability kill,
+  capability net_admin,
+  capability setgid,
+  capability setuid,
+  capability sys_nice,
+  capability sys_tty_config,
+
+  signal (receive) set=term peer=gdm,
+
+  network netlink raw,
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/gnome-keyring-daemon   rPx,
+  /{usr/,}lib/gdm-wayland-session    rPx,
+  /{usr/,}lib/gdm-x-session          rPx,
+  /etc/gdm/{Pre,Post}Session/Default rix,
+
+  /etc/motd r,
+  /etc/shells r,
+  /etc/locale.conf r,
+  /etc/environment r,
+  /etc/gdm/custom.conf r,
+  /etc/security/limits.d/{,*.conf} r,
+
+  /usr/share/gdm/gdm.schemas r,
+
+  @{run}/faillock/[a-zA-z0-9]* rwk,
+  @{run}/systemd/sessions/[0-9].ref rw,
+  @{run}/systemd/users/[0-9]* r,
+  @{run}/utmp rwk,
+
+  owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/loginuid rw,
+  owner @{PROC}/@{pid}/uid_map r,
+  owner @{PROC}/sys/kernel/random/boot_id r,
+
+  /dev/tty rw,
+  /dev/tty[0-9]* rw,
+
+  include if exists <local/gdm-session-worker>
+}