Profiles update.

apparmor.d/profiles-s-z/udisksd

@@ -73,8 +73,9 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
   owner @{PROC}/@{pid}/mountinfo r,
   owner @{PROC}/@{pid}/mounts r,
   owner @{PROC}/@{pid}/fd/ r,
-        @{PROC}/swaps r,
+        @{PROC}/cmdline r,
         @{PROC}/devices r,
+        @{PROC}/swaps r,
 
   # To be able to initialize device-mapper disk devices
   /dev/mapper/ r,

apparmor.d/profiles-s-z/xdg-desktop-portal

@@ -10,7 +10,7 @@ include <tunables/global>
 profile xdg-desktop-portal @{exec_path} {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
-  include <abstractions/freedesktop.org.d>
+  include <abstractions/freedesktop.org>
 
   capability sys_ptrace,
 
@@ -23,7 +23,6 @@ profile xdg-desktop-portal @{exec_path} {
   /{usr/,}lib/x r,
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
-  /usr/share/mime/mime.cache r,
   /usr/share/pipewire/client.conf r,
   /usr/share/xdg-desktop-portal/portals/{,*.portal} r,
 

apparmor.d/profiles-s-z/xdg-desktop-portal-gnome

@@ -11,11 +11,13 @@ profile xdg-desktop-portal-gnome @{exec_path} {
   include <abstractions/base>
   include <abstractions/fonts>
   include <abstractions/freedesktop.org>
+  include <abstractions/gtk>
   include <abstractions/user-download>
 
   @{exec_path} mr,
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
+  /usr/share/themes/{,**} r,
   /usr/share/X11/xkb/{,**} r,
 
   owner @{run}/user/@{uid}/wayland-cursor-shared-* rw,

apparmor.d/profiles-s-z/xorg

@@ -1,23 +1,19 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2017-2021 Mikhail Morfikov
+# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
 
 include <tunables/global>
 
-# The attach_disconnected flag is needed when xserver is started via startx, or the mouse/keyboard
-# won't work.
-#  operation="getattr" info="Failed name lookup - disconnected path" error=-13 profile="xorg"
-#  name="dev/dri/card*"
-#  operation="getattr" info="Failed name lookup - disconnected path" error=-13 profile="xorg"
-#  name="dev/input/event*"
 @{exec_path}  = /{usr/,}bin/X
 @{exec_path} += /{usr/,}bin/Xorg
 @{exec_path} += /{usr/,}lib/xorg/Xorg
 profile xorg @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/opencl-intel>
+  include <abstractions/opencl-nvidia>
   include <abstractions/vulkan>
   include <abstractions/fonts>
   include <abstractions/fontconfig-cache-read>