feat(profile): general update.

apparmor.d/groups/grub/grub-probe

@@ -30,14 +30,21 @@ profile grub-probe @{exec_path} {
 
   @{PROC}/@{pids}/mountinfo r,
   @{PROC}/devices r,
-  
+
   /dev/*vg*/ r,
   /dev/bsg/ r,
+  /dev/bus/ r,
+  /dev/bus/usb/ r,
+  /dev/bus/usb/@{int}/ r,
   /dev/cpu/ r,
   /dev/cpu/@{int}/ r,
+  /dev/dma_heap/ r,
   /dev/dri/ r,
   /dev/dri/by-path/ r,
   /dev/hugepages/ r,
+  /dev/input/ r,
+  /dev/input/by-id/ r,
+  /dev/input/by-path/ r,
   /dev/mapper/control rw,
   /dev/mqueue/ r,
   /dev/shm/ r,

apparmor.d/groups/network/nm-dispatcher

@@ -13,6 +13,7 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus-system>
   include <abstractions/nameservice-strict>
+  include <abstractions/python>
 
   capability net_admin,
   capability sys_nice,
@@ -30,6 +31,7 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
   @{exec_path} mr,
 
   @{sh_path}                rix,
+  @{bin}/python3.@{int}     rix,
   @{bin}/basename           rix,
   @{bin}/cat                rix,
   @{bin}/chronyc           rPUx,

apparmor.d/groups/xfce/mousepad

@@ -18,11 +18,16 @@ profile mousepad @{exec_path} {
 
   @{open_path}  rPx -> child-open-help,
 
+  /usr/share/hunspell/{,**} r,
+
   owner @{user_config_dirs}/Mousepad/ rw,
-  owner @{user_config_dirs}/Mousepad/{,**} rw,
+  owner @{user_config_dirs}/Mousepad/** rwk,
+
+  owner @{user_config_dirs}/enchant/ rw,
+  owner @{user_config_dirs}/enchant/ rwk,
 
   owner @{user_share_dirs}/Mousepad/ rw,
-  owner @{user_share_dirs}/Mousepad/{,**} rw,
+  owner @{user_share_dirs}/Mousepad/** rwk,
 
   include if exists <local/mousepad>
 }

apparmor.d/groups/xfce/startxfce

@@ -27,7 +27,7 @@ profile startxfce @{exec_path} {
   /etc/X11/xinit/xinitrc.d/{,**} r,
   /etc/xdg/xfce4/{,**} r,
 
-  profile systemctl {
+  profile systemctl flags=(attach_disconnected) {
     include <abstractions/base>
     include <abstractions/app/systemctl>
   

apparmor.d/groups/xfce/thunar

@@ -19,11 +19,13 @@ profile thunar @{exec_path} {
 
   @{exec_path} mr,
 
-  @{bin}/thunar-volman rPx,
-  @{open_path} rPx -> child-open,
+  @{bin}/thunar-volman  rPx,
+  @{bin}/dbus-launch    rCx -> dbus,
+  @{open_path}          rPx -> child-open,
 
   /usr/share/ r,
   /usr/share/anon-apps-config/share/{,**} r, #aa:only whonix
+  /usr/share/gvfs/{,**} r,
   /usr/share/Thunar/{,**} r,
 
   /etc/fstab r,
@@ -50,5 +52,14 @@ profile thunar @{exec_path} {
 
   owner @{PROC}/@{pid}/mountinfo r,
 
+  profile dbus {
+    include <abstractions/base>
+    include <abstractions/nameservice-strict>
+
+    @{bin}/dbus-launch   mr,
+
+    include if exists <local/thunar_dbus>
+  }
+
   include if exists <local/thunar>
 }

apparmor.d/groups/xfce/xfce-notifyd

@@ -15,6 +15,13 @@ profile xfce-notifyd @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/xfce>
 
+  # TODO: local only
+  network inet dgram,
+  network inet stream,
+  network inet6 dgram,
+  network inet6 stream,
+  network netlink raw,
+
   @{exec_path} mr,
 
   owner @{user_cache_dirs}/xfce4/notifyd/ rw,

apparmor.d/groups/xfce/xfce-session

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = @{bin}/xfce4-session
-profile xfce-session @{exec_path} {
+profile xfce-session @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/app-launcher-user>
   include <abstractions/graphics>
@@ -47,20 +47,22 @@ profile xfce-session @{exec_path} {
   /etc/xdg/autostart/ r,
   /etc/xdg/autostart/*.desktop r,
 
+  owner @{user_cache_dirs}/sessions/{,**} rw,
+
   owner @{tmp}/.xfsm-ICE-@{rand6} rw,
 
   owner @{PROC}/@{pid}/stat r,
 
   /dev/tty rw,
 
-  profile systemctl {
+  profile systemctl flags=(attach_disconnected) {
     include <abstractions/base>
     include <abstractions/app/systemctl>
   
     include if exists <local/xfce-session_systemctl>
   }
 
-  profile dbus {
+  profile dbus flags=(attach_disconnected) {
     include <abstractions/base>
     include <abstractions/bus-session>
 

apparmor.d/groups/xfce/xfdesktop

@@ -22,7 +22,7 @@ profile xfdesktop @{exec_path} {
 
   /etc/fstab r,
 
-  owner @{HOME}/@{XDG_DESKTOP_DIR}/ r,
+  owner @{HOME}/@{XDG_DESKTOP_DIR}/{,**} r,
 
   owner @{user_config_dirs}/Thunar/{,**} rw,
   owner @{user_config_dirs}/xfce4/desktop/{,**} rw,