feat(profile): general update.

apparmor.d/profiles-m-r/ntfs-3g

@@ -22,15 +22,6 @@ profile ntfs-3g @{exec_path} flags=(attach_disconnected) {
   capability setuid,
   capability sys_admin,
 
-  @{exec_path} mr,
-
-  @{bin}/kmod rPx,  # To load the fuse kernel module
-
-  # Mount points
-  @{MOUNTDIRS}/ r,
-  @{MOUNTS}/ r,
-  @{MOUNTS}/*/ r,
-
   # Allow to mount ntfs disks only under the /media/, /run/media, and /mnt/ dirs
   mount fstype=fuseblk /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTDIRS},
   mount fstype=fuseblk /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTS}/,
@@ -47,12 +38,22 @@ profile ntfs-3g @{exec_path} flags=(attach_disconnected) {
   umount @{MOUNTS}/,
   umount @{MOUNTS}/*/,
 
+  @{exec_path} mr,
+
+  @{bin}/kmod rPx,  # To load the fuse kernel module
+
+  # Mount points
+  @{MOUNTDIRS}/ r,
+  @{MOUNTS}/ r,
+  @{MOUNTS}/*/ r,
+
         @{PROC}/@{pids}/mountinfo r,
         @{PROC}/@{pids}/task/@{tid}/status r,
         @{PROC}/swaps r,
   owner @{PROC}/@{pid}/mounts r,
 
   /dev/fuse rw,
+  /dev/tty@{int} rw,
 
   include if exists <local/ntfs-3g>
 }

apparmor.d/profiles-m-r/pass

@@ -60,7 +60,7 @@ profile pass @{exec_path} {
   /usr/share/terminfo/** r,
 
   owner @{user_password_store_dirs}/{,**} rw,
-  owner /dev/shm/pass.*/{,*} rw,
+  owner /dev/shm/pass.@{rand}/{,*} rw,
 
   @{sys}/devices/system/node/ r,
 
@@ -90,7 +90,7 @@ profile pass @{exec_path} {
 
     owner @{user_password_store_dirs}/{,**/} r,
 
-    owner /dev/shm/pass.*/{,*} rw,
+    owner /dev/shm/pass.@{rand}/{,*} rw,
 
     deny owner @{HOME}/ r,
 
@@ -124,7 +124,7 @@ profile pass @{exec_path} {
     owner @{user_password_store_dirs}/** rwkl -> @{HOME}/.password-store/**,
 
     owner @{tmp}/.git_vtag_tmp@{rand6} rw,  # For git log --show-signature
-    owner /dev/shm/pass.*/.git_vtag_tmp@{rand6} rw,
+    owner /dev/shm/pass.@{rand}/.git_vtag_tmp@{rand6} rw,
 
     include if exists <local/pass_git>
   }
@@ -144,7 +144,7 @@ profile pass @{exec_path} {
 
     owner @{user_password_store_dirs}/   rw,
     owner @{user_password_store_dirs}/** rwkl -> @{HOME}/.password-store/**,
-    owner /dev/shm/pass.*/{,*} rw,
+    owner /dev/shm/pass.@{rand}/* rw,
     owner @{tmp}/.git_vtag_tmp@{rand6} rw,  # For git log --show-signature
 
     owner /dev/pts/@{int} rw,

apparmor.d/profiles-m-r/passwd

@@ -21,7 +21,7 @@ profile passwd @{exec_path} {
   capability net_admin,
   capability setuid,
 
-  signal (receive) set=(term, kill) peer=gnome-control-center,
+  signal receive set=(term kill) peer=gnome-control-center,
 
   network netlink raw,
 

apparmor.d/profiles-m-r/protonmail

@@ -1,4 +1,5 @@
 # apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
 # Copyright (C) 2024 curiosityseeker
 # SPDX-License-Identifier: GPL-2.0-only
 
@@ -28,7 +29,7 @@ profile protonmail @{exec_path} flags=(complain) {
   @{exec_path} mrix,
 
   @{bin}/xdg-settings Px,
-  @{open_path}        rpx -> child-open,
+  @{open_path}        Px -> child-open,
 
   owner @{user_config_dirs}/ibus/bus/ r,
 

apparmor.d/profiles-m-r/rpi-imager

@@ -8,24 +8,17 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = @{bin}/rpi-imager
-profile rpi-imager @{exec_path} {
+profile rpi-imager @{exec_path} flags=(complain) {
   include <abstractions/base>
   include <abstractions/dconf-write>
+  include <abstractions/desktop>
   include <abstractions/disks-write>
-  include <abstractions/dri-common>
-  include <abstractions/dri-enumerate>
   include <abstractions/fontconfig-cache-read>
-  include <abstractions/fonts>
-  include <abstractions/freedesktop.org>
-  include <abstractions/gtk>
-  include <abstractions/mesa>
+  include <abstractions/graphics>
   include <abstractions/nameservice-strict>
-  include <abstractions/opencl>
-  include <abstractions/qt5>
   include <abstractions/qt5-shader-cache>
   include <abstractions/ssl_certs>
   include <abstractions/user-download-strict>
-  include <abstractions/vulkan>
 
   #capability sys_admin,
   # deny capability sys_nice,
@@ -42,18 +35,15 @@ profile rpi-imager @{exec_path} {
   @{bin}/lsblk rPx,
 
   /etc/fstab r,
-  /etc/X11/cursors/*.theme r,
-  /usr/share/hwdata/pnp.ids r,
-  /usr/share/X11/xkb/{,**} r,
 
   /etc/machine-id r,
   /var/lib/dbus/machine-id r,
 
   owner "@{user_cache_dirs}/Raspberry Pi/" rw,
   owner "@{user_cache_dirs}/Raspberry Pi/**" rwl -> "@{user_cache_dirs}/Raspberry Pi/**",
-  owner "@{user_config_dirs}/Raspberry Pi/{,**}" rw,
-  owner @{user_cache_dirs}/ rw,
-  owner @{user_config_dirs}/QtProject.conf r,
+
+  owner "@{user_config_dirs}/Raspberry Pi/" rw,
+  owner "@{user_config_dirs}/Raspberry Pi/**" rwlk -> "@{user_config_dirs}/Raspberry Pi/**",
 
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/fd/ r,