Profiles update.

apparmor.d/groups/browsers/chromium-chromium

@@ -175,6 +175,7 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
 
   # Silencer
   deny @{CHROMIUM_INSTALLDIR}/** w,
+  deny @{user_share_dirs}/gvfs-metadata/* r,
 
   # file_inherit
   owner /dev/tty[0-9]* rw,

apparmor.d/groups/gnome/gnome-session-binary

@@ -57,7 +57,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
   /var/lib/gdm/.config/gnome-session/saved-session/ rw,
 
   owner @{user_config_dirs}/gnome-session/ rw,
-  owner @{user_config_dirs}/gnome-session/saved-session/ r,
+  owner @{user_config_dirs}/gnome-session/saved-session/ rw,
   owner @{user_config_dirs}/gtk-3.0/bookmarks rw,
   owner @{user_config_dirs}/gtk-3.0/bookmarks.[0-9A-Z]* rw,
 

apparmor.d/groups/gnome/tracker-miner

@@ -20,7 +20,7 @@ profile tracker-miner @{exec_path} {
   /usr/share/applications/{,mimeinfo.cache} r,
   /usr/share/mime/mime.cache r,
 
-  /var/lib/flatpak/exports/share/applications/mimeinfo.cache r,
+  /var/lib/flatpak/exports/share/applications/{,mimeinfo.cache} r,
   owner /var/tmp/etilqs_[0-9a-f]* rw,
 
   # Allow to search user files

apparmor.d/groups/pacman/archlinux-java

@@ -10,6 +10,8 @@ include <tunables/global>
 profile archlinux-java @{exec_path} {
   include <abstractions/base>
 
+  capability dac_read_search,
+
   @{exec_path} mr,
 
   /{usr/,}bin/basename  rix,
@@ -19,5 +21,11 @@ profile archlinux-java @{exec_path} {
   /{usr/,}bin/readlink  rix,
   /{usr/,}bin/unlink    rix,
 
+  /dev/tty rw,
+
+  # Inherit Silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
   include if exists <local/archlinux-java>
 }

apparmor.d/groups/pacman/pacman

@@ -139,6 +139,9 @@ profile pacman @{exec_path} {
 
     owner /etc/pacman.d/gnupg/ rw,
     owner /etc/pacman.d/gnupg/** rwkl,
+
+    deny network inet stream,
+    deny network inet6 stream,
   }
 
   include if exists <usr/pacman.d>

apparmor.d/groups/pacman/pacman-key

@@ -9,7 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}bin/pacman-key
 profile pacman-key @{exec_path} {
   include <abstractions/base>
-  
+
   capability dac_read_search,
   capability mknod,
 
@@ -29,7 +29,7 @@ profile pacman-key @{exec_path} {
   /{usr/,}bin/wc           rix,
 
   /usr/share/makepkg/{,**} r,
-  /usr/share/pacman/keyrings/* r,
+  /usr/share/pacman/keyrings/{,*} r,
   /usr/share/terminfo/x/xterm-256color r,
 
   /dev/tty rw,
@@ -47,11 +47,13 @@ profile pacman-key @{exec_path} {
     /{usr/,}bin/gpg        mr,
     /{usr/,}bin/gpg-agent  rix,
 
-    /usr/share/pacman/keyrings/* r,
+    /usr/share/pacman/keyrings/{,*} r,
 
     /etc/pacman.d/gnupg/ rw,
     /etc/pacman.d/gnupg/** rwkl,
 
+    @{HOME}/.gnupg/gpg.conf r,
+
     owner @{PROC}/@{pid}/fd/ r,
 
     # Inherit Silencer

apparmor.d/groups/virt/cockpit-bridge

@@ -48,6 +48,7 @@ profile cockpit-bridge @{exec_path} {
   owner @{PROC}/@{pid}/mounts r,
         @{PROC}/@{pids}/net/dev r,
         @{PROC}/1/cgroup r,
+        @{PROC}/cmdline r,
         @{PROC}/diskstats r,
         @{PROC}/sys/kernel/random/boot_id r,
         @{PROC}/uptime r,