Various profile updates

Signed-off-by: Jeroen Rijken <jeroen.rijken@xs4all.nl>

apparmor.d/groups/freedesktop/xdg-mime

@@ -21,6 +21,7 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) {
   @{bin}/cut        rix,
   @{bin}/file       rix,
   @{bin}/head       rix,
+  @{bin}/kbuildsycoca5 rPx,
   @{bin}/mv         rix,
   @{bin}/readlink   rix,
   @{bin}/realpath   rix,

apparmor.d/groups/kde/kbuildsycoca5

@@ -0,0 +1,30 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2024 Jeroen Rijken
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{bin}/kbuildsycoca5
+profile kbuildsycoca5 @{exec_path} flags=(attach_disconnected) {
+  include <abstractions/base>
+  include <abstractions/nameservice-strict>
+
+  @{exec_path} mr,
+
+  /usr/share/applications/kde-mimeapps.list r,
+  /usr/share/mime/mime.cache r,
+  /usr/share/mime/types r,
+  /var/lib/flatpak/exports/share/mime/types r,
+
+  owner @{user_cache_dirs}/ksycoca5_* l -> @{user_cache_dirs}/#@{int},
+  owner @{user_cache_dirs}/ksycoca5_* rw,
+  owner @{user_config_dirs}/mimeapps.list r,
+  owner @{user_share_dirs}/applications/mimeapps.list r,
+  owner @{user_share_dirs}/mime/types r,
+
+  /dev/tty r,
+
+  include if exists <local/kbuildsycoca5>
+}

apparmor.d/groups/kde/plasmashell

@@ -44,9 +44,11 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
 
   @{exec_path} mr,
 
-  @{lib}/libheif/{,**} mr,
-
-  @{bin}/dolphin          rPUx,
+  @{lib}/libheif/            r,
+  @{lib}/libheif/{,**}      mr,
+  @{lib}/kf5/kioslave5     rPx,
+  @{lib}/kf5/kdesu{,d}     rix,
+  @{bin}/dolphin          rPUx, # TODO: rPx,
   @{bin}/ksysguardd        rix,
   @{bin}/plasma-discover  rPUx,
   @{bin}/xrdb              rPx,

apparmor.d/groups/kde/sddm-xsession

@@ -10,6 +10,7 @@ include <tunables/global>
 @{exec_path} = /etc/sddm/Xsession
 profile sddm-xsession @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-session>
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
   include <abstractions/shells>
@@ -25,14 +26,17 @@ profile sddm-xsession @{exec_path} {
   @{bin}/csh        rix,
   @{bin}/date       rix,
   @{bin}/fish       rix,
-  @{bin}/id         rix,
+  @{bin}/gettext.sh r,
   @{bin}/gpgconf   rCx -> gpg,
+  @{bin}/id         rix,
+  @{bin}/locale     rix,
+  @{bin}/locale-check rix,
+  @{bin}/mktemp     rix,
+  @{bin}/mv         rix,
+  @{bin}/rm         rix,
+  @{bin}/sed        rix,
   @{bin}/stat       rix,
   @{bin}/tail       rix,
-  @{bin}/mv         rix,
-  @{bin}/locale-check rPx,
-  @{bin}/mktemp     rix,
-  @{bin}/rm         rix,
   @{bin}/tcsh       rix,
   @{bin}/tempfile   rix,
   @{bin}/touch      rix,
@@ -57,12 +61,18 @@ profile sddm-xsession @{exec_path} {
   /etc/default/{,*} r,
   /etc/X11/{,**} r,
 
-  owner @{HOME}/.xsession-errors w,
+  owner @{HOME}/.xinputrc r,
+  owner @{HOME}/.xsession-errors rw,
+        @{HOME}/tmp.* rw,
+
+  @{system_share_dirs}/im-config/data/{,*} r,
+  @{system_share_dirs}/im-config/xinputrc.common
 
   owner @{user_share_dirs}/sddm/xorg-session.log w,
 
   owner /tmp/xsess-env-* rw,
   owner /tmp/file* rw,
+  owner /tmp/tmp.* rw,
 
   owner @{PROC}/@{pid}/loginuid r,
 

apparmor.d/groups/kde/startplasma

@@ -11,6 +11,7 @@ profile startplasma @{exec_path} {
   include <abstractions/base>
   include <abstractions/audio-client>
   include <abstractions/kde-strict>
+  include <abstractions/bus-session>
 
   signal (receive) set=(hup) peer=@{p_systemd},
   signal (receive) set=(term) peer=sddm,
@@ -20,12 +21,17 @@ profile startplasma @{exec_path} {
   @{sh_path}  rix,
   @{bin}/env  rix,
 
+  @{bin}/{,ba,da}sh         rix,
+  @{bin}/env                rix,
+  @{bin}/grep               rix,
   @{bin}/kapplymousetheme  rPUx,
   @{bin}/ksplashqml        rPUx,
   @{bin}/plasma_session     rPx,
   @{bin}/xrdb               rPx,
   @{bin}/xsetroot           rPx,
 
+  @{lib}/@{multiarch}/libexec/plasma-sourceenv.sh r,
+
   /usr/share/color-schemes/{,**} r,
   /usr/share/desktop-directories/{,**} r,
   /usr/share/knotifications{5,6}/{,**} r,
@@ -33,10 +39,16 @@ profile startplasma @{exec_path} {
   /usr/share/kservicetypes5/{,**} r,
   /usr/share/plasma/{,**} r,
 
+  /etc/locale.alias r,
   /etc/machine-id r,
   /etc/xdg/kcminputrc r,
   /etc/xdg/menus/{,**} r,
-  /etc/xdg/plasma-workspace/env/{,**} r,
+  /etc/xdg/plasma-workspace/env/{,*} r,
+
+  /var/lib/flatpak/exports/share/mime/ r,
+
+  @{HOME}/ r,
+  @{HOME}/.xsession-errors w,
 
         @{user_cache_dirs}/ksycoca{5,6}_* rwkl -> @{user_cache_dirs}/#@{int},
   owner @{user_cache_dirs}/#@{int} rwk,
@@ -69,7 +81,9 @@ profile startplasma @{exec_path} {
 
   owner @{run}/user/@{uid}/ r,
 
-  @{PROC}/sys/kernel/core_pattern r,
+        @{PROC}/sys/kernel/core_pattern r,
+        @{PROC}/sys/kernel/random/boot_id r,
+  owner @{PROC}/@{pid}/maps r,
 
   /dev/tty r,
   /dev/tty@{int} rw,

apparmor.d/groups/network/nm-dispatcher

@@ -22,12 +22,18 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
 
   #aa:dbus own bus=system name=org.freedesktop.nm_dispatcher
 
+  dbus send bus=system path=/org/freedesktop
+            interface=org.freedesktop.DBus.ObjectManager
+            member=GetManagedObjects
+            peer=(name=:*, label=NetworkManager),
+
   @{exec_path} mr,
 
   @{sh_path}                rix,
   @{bin}/basename           rix,
   @{bin}/cat                rix,
   @{bin}/chronyc           rPUx,
+  @{bin}/chown              rix,
   @{bin}/date               rix,
   @{bin}/gawk               rix,
   @{bin}/grep               rix,
@@ -52,15 +58,21 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
   /etc/NetworkManager/dispatcher.d/** rix,
   /etc/dhcp/dhclient-exit-hooks.d/ntp r,
 
+  # chown
+  / r,
+
   /usr/share/tlp/{,**} rw,
 
   /etc/sysconfig/network/config r,
   /etc/fstab r,
 
-  @{run}/systemd/notify rw,
-  @{run}/tlp/{,*} rw,
-  @{run}/chrony-dhcp/ rw,
-  @{run}/ntp.conf.dhcp rw,
+        @{run}/chrony-dhcp/ rw,
+        @{run}/ntp.conf.dhcp rw,
+        @{run}/systemd/netif/leases/ r,
+        @{run}/systemd/notify rw,
+        @{run}/tlp/{,*} rw,
+  owner @{run}/ntp.conf.dhcp.@{rand6} rw,
+  owner /etc/ntp.conf r,
 
   @{sys}/class/net/ r,
 
@@ -85,8 +97,11 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
   profile invoke-rc {
     include <abstractions/base>
 
+    @{bin}/invoke-rc.d rm,
     @{sh_path}       rix,
+    @{bin}/basename  rix,
     @{bin}/ls        rix,
+    # This doesn't seem to work, profile transition not found.
     @{bin}/systemctl rCx -> systemctl,
 
     / r,