Profiles update.

apparmor.d/profiles-a-f/borg

@@ -12,14 +12,9 @@ profile borg @{exec_path} {
   include <abstractions/base>
   include <abstractions/python>
 
-  # For reading files of other users as root
   capability dac_read_search,
-
-  # Needed to mount backup files
-  capability sys_admin,
-
-  #
   capability fowner,
+  capability sys_admin,
 
   network inet dgram,
   network inet6 dgram,
@@ -60,11 +55,13 @@ profile borg @{exec_path} {
   owner /tmp/* rw,
   owner /tmp/tmp*/ rw,
   owner /tmp/tmp*/idx rw,
+  owner /tmp/tmp*/file rw,
   owner /tmp/borg-cache-*/ rw,
   owner /tmp/borg-cache-*/* rw,
   owner /var/tmp/* rw,
   owner /var/tmp/tmp*/ rw,
   owner /var/tmp/tmp*/idx rw,
+  owner /var/tmp/tmp*/file rw,
 
   # Dirs that can be backed up
   /            r,

apparmor.d/profiles-a-f/browserpass

@@ -30,16 +30,13 @@ profile browserpass @{exec_path} flags=(attach_disconnected) {
   owner @{PROC}/@{pid}/mountinfo r,
 
   # Inherit Silencer
-  deny network inet6 dgram,
-  deny network inet dgram,
-  deny network inet6 stream,
-  deny network inet stream,
-  deny owner @{HOME}/.mozilla/firefox/[0-9a-z]*.default/storage/default/{,**} r,
+  deny network inet6,
+  deny network inet,
+  deny owner @{HOME}/.mozilla/firefox/[0-9a-z]*.default/storage/default/{,**} rw,
   deny owner @{HOME}/@{XDG_DOWNLOAD_DIR}/{,**} rw,
   deny owner @{run}/user/@{uid}/gnome-shell-disable-extensions w,
   deny owner @{user_share_dirs}/gvfs-metadata/{,**} r,
-  deny /dev/dri/card[0-9]* rw,
-  deny /dev/dri/renderD128 rw,
+  deny /dev/dri/* rw,
 
   include if exists <local/browserpass>
 }

apparmor.d/profiles-a-f/downloadhelper

@@ -38,6 +38,7 @@ profile downloadhelper @{exec_path} {
   @{sys}/devices/system/node/node[0-9]*/meminfo r,
 
   deny @{PROC}/version r,
+  deny @{user_share_dirs}/gvfs-metadata/* r,
 
   include if exists <local/downloadhelper>
 }