Various updates all over

Signed-off-by: Jeroen Rijken <jeroen.rijken@xs4all.nl>

apparmor.d/groups/_full/bwrap

@@ -14,6 +14,7 @@ profile bwrap @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   include <abstractions/common/bwrap>
   include <abstractions/common/app>
   include <abstractions/dbus>
+  include <abstractions/bus/org.freedesktop.NetworkManager>
   include <abstractions/fontconfig-cache-write>
 
   capability dac_override,

apparmor.d/groups/freedesktop/xdg-desktop-portal

@@ -62,9 +62,9 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
   @{bin}/nautilus    rPx,
   @{bin}/snap       rPUx,
 
-  @{bin}/kreadconfig5                                 rPx,
-  @{lib}/xdg-desktop-portal-validate-icon             rPUx,
-  @{open_path}                                        rPx -> child-open,
+  @{bin}/kreadconfig5                     rPx,
+  @{lib}/xdg-desktop-portal-validate-icon rPUx,
+  @{open_path}                            rPx -> child-open,
 
   / r,
   /.flatpak-info r,

apparmor.d/groups/kde/kauth-kded-smart-helper

@@ -9,8 +9,17 @@ include <tunables/global>
 @{exec_path} = @{lib}/{,kf6/}kauth/{,libexec/}kded-smart-helper
 profile kauth-kded-smart-helper @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-system>
+  include <abstractions/bus/org.freedesktop.PolicyKit1>
   include <abstractions/nameservice-strict>
 
+  # dbus: own bus=system name=org.kde.kded.smart
+
+  dbus send bus=system path=/
+            interface=org.kde.kf5auth
+            member=remoteSignal
+            peer=(name=org.freedesktop.DBus, label=kded5),
+
   @{exec_path} mr,
 
   @{bin}/smartctl rPx,
@@ -18,4 +27,4 @@ profile kauth-kded-smart-helper @{exec_path} {
   /usr/share/icu/@{int}.@{int}/*.dat r,
 
   include if exists <local/kauth-kded-smart-helper>
-}
+}

apparmor.d/groups/kde/kded

@@ -34,14 +34,11 @@ profile kded @{exec_path} {
 
   signal (send) set=hup peer=xsettingsd,
 
-  dbus receive bus=system path=/org/freedesktop/NetworkManager/SecretAgent
-       interface=org.freedesktop.NetworkManager.SecretAgent
-       member=CancelGetSecrets
-       peer=(label=NetworkManager),
+  # dbus: own bus=system name=com.redhat.NewPrinterNotification
 
   dbus receive bus=system path=/org/freedesktop/NetworkManager/SecretAgent
        interface=org.freedesktop.NetworkManager.SecretAgent
-       member=CancelGetSecrets
+       member={GetSecrets,CancelGetSecrets}
        peer=(label=NetworkManager),
 
   dbus receive bus=system path=/org/freedesktop/NetworkManager/AccessPoint/@{int}
@@ -58,6 +55,30 @@ profile kded @{exec_path} {
        interface=org.freedesktop.NetworkManager.AgentManager
        peer=(label=NetworkManager),
 
+  dbus send bus=system path=/org/freedesktop/NetworkManager/AgentManager
+       interface=org.freedesktop.NetworkManager.AgentManager
+       peer=(label=NetworkManager),
+
+  dbus send bus=system path=/org/freedesktop/bolt
+       interface=org.freedesktop.bolt1.Manager
+       member=ListDevices
+       peer=(name="{:*,org.freedesktop.bolt}", label=boltd),
+
+  dbus send bus=system path=/org/freedesktop/bolt{,/**}
+       interface=org.freedesktop.DBus.Properties
+       member=Get,
+       peer=(name="{:*,org.freedesktop.bolt}", label=boltd),
+
+  dbus receive bus=system path=/
+       interface=org.kde.kf5auth
+       member=remoteSignal,
+       peer=(name=:*, label=kauth-kded-smart-helper),
+
+  dbus send bus=system path=/
+       interface=org.kde.kf5auth
+       member=performAction,
+       peer=(name="{:*,org.kde.kded.smart}", label=kauth-kded-smart-helper),
+
   @{exec_path} mrix,
 
   @{bin}/kcminit            rPx,
@@ -139,7 +160,7 @@ profile kded @{exec_path} {
   owner @{user_config_dirs}/Trolltech.conf{,.@{rand6}} rwl,
   owner @{user_config_dirs}/xsettingsd/{,**} rw,
 
-        @{user_share_dirs}/kcookiejar/cookies{,.@{rand6}} rwkl -> @{user_share_dirs}/kcookiejar/#@{int},
+  owner @{user_share_dirs}/kcookiejar/cookies{,.@{rand6}} rwkl -> @{user_share_dirs}/kcookiejar/#@{int},
   owner @{user_share_dirs}/icc/{,edid-*} r,
   owner @{user_share_dirs}/kcookiejar/#@{int} rw,
   owner @{user_share_dirs}/kcookiejar/cookies.lock rwk,
@@ -200,3 +221,10 @@ profile kded @{exec_path} {
 
   include if exists <local/kded>
 }
+
+ALLOWED kded5 open owner @{user_cache_dirs}/update-manager-core/meta-release-lts comm=python3 requested_mask=r denied_mask=r
+ALLOWED kded5 open owner @{user_config_dirs}/kcmfonts comm=kded5 requested_mask=r denied_mask=r
+ALLOWED kded5 open owner @{user_config_dirs}/plasmavaultrc comm=kded5 requested_mask=r denied_mask=r
+ALLOWED kded5 open owner @{user_config_dirs}/touchpadxlibinputrc comm=kded5 requested_mask=r denied_mask=r
+ALLOWED kded5 open owner @{user_lib_dirs}/python3.10/site-packages/ comm=python3 requested_mask=r denied_mask=r
+ALLOWED kded5 open owner /tmp/#@{int} comm=python3 requested_mask=wr denied_mask=wr

apparmor.d/groups/kde/ksmserver

@@ -18,6 +18,8 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
 
   signal (send) set=(usr1,term) peer=kscreenlocker-greet,
 
+  ptrace (read) peer=kbuildsycoca5,
+
   unix (send, receive) type=stream peer=(label="kscreenlocker-greet",addr=none),
 
   @{exec_path} mr,
@@ -36,10 +38,10 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   /usr/share/kservices{5,6}/{,**} r,
   /usr/share/kservicetypes{5,6}/{,**} r,
 
-  /etc/xdg/menus/applications-merged/ r,
+  /etc/xdg/menus/applications-merged/{,*} r,
   /etc/machine-id r,
   /etc/xdg/kscreenlockerrc r,
-  /etc/xdg/menus/ r,
+  /etc/xdg/menus/{,*} r,
 
   /var/lib/flatpak/exports/share/mime/ r,
 

apparmor.d/groups/kde/plasmashell

@@ -47,6 +47,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
   @{lib}/libheif/            r,
   @{lib}/libheif/{,**}      mr,
   @{lib}/kf5/kioslave5     rPx,
+  @{lib}/kf6/kioworker     rPx,
   @{lib}/kf5/kdesu{,d}     rix,
   @{bin}/dolphin          rPUx, # TODO: rPx,
   @{bin}/ksysguardd        rix,

apparmor.d/groups/kde/systemsettings

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/systemsettings
 profile systemsettings @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-session>
   include <abstractions/graphics>
   include <abstractions/kde-strict>
   include <abstractions/nameservice-strict>
@@ -20,6 +21,8 @@ profile systemsettings @{exec_path} {
 
   @{bin}/kcminit rPx,
 
+  /usr/share/kglobalaccel/org.kde.krunner.desktop r,
+  /usr/share/kcmkeys/{,*.kksrc} r,
   /usr/share/kcm_networkmanagement/{,**} r,
   /usr/share/kinfocenter/{,**} r,
   /usr/share/kpackage/{,**} r,
@@ -29,10 +32,14 @@ profile systemsettings @{exec_path} {
   /usr/share/plasma/{,**} r,
   /usr/share/sddm/themes/{,**} r,
   /usr/share/systemsettings/{,**} r,
+  /usr/share/kinfocenter/{,**} r,
+  /usr/share/sddm/themes/{,**} r,
+
+  /var/lib/flatpak/exports/share/mime/ r,
 
   /etc/fstab r,
   /etc/machine-id r,
-  /etc/xdg/menus/ r,
+  /etc/xdg/menus/{,applications-merged/} r,
   /etc/xdg/ui/ui_standards.rc r,
   /var/lib/dbus/machine-id r,
 
@@ -48,12 +55,16 @@ profile systemsettings @{exec_path} {
   owner @{user_cache_dirs}/systemsettings/** rwlk -> @{user_cache_dirs}/systemsettings/**,
 
   owner @{user_config_dirs}/#@{int} rw,
+  owner @{user_config_dirs}/khotkeysrc r,
+  owner @{user_config_dirs}/menus/ r,
+  owner @{user_config_dirs}/plasmarc r,
   owner @{user_config_dirs}/kde.org/{,**} rwlk,
   owner @{user_config_dirs}/kdedefaults/plasmarc r,
   owner @{user_config_dirs}/kinfocenterrc* rwlk,
   owner @{user_config_dirs}/systemsettingsrc.lock rwk,
   owner @{user_config_dirs}/systemsettingsrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
 
+  owner @{user_share_dirs}/kservices5/{,ServiceMenus/} r,
   owner @{user_share_dirs}/kactivitymanagerd/resources/database rk,
   owner @{user_share_dirs}/kactivitymanagerd/resources/database-shm rwk,
   owner @{user_share_dirs}/kactivitymanagerd/resources/database-wal rw,