Profiles update.

apparmor.d/groups/browsers/chromium-chromium

@@ -11,7 +11,7 @@ include <tunables/global>
 @{CHROMIUM_CACHEDIR} = @{user_cache_dirs}/chromium
 
 @{exec_path} = @{CHROMIUM_INSTALLDIR}/chromium
-profile chromium-chromium @{exec_path} {
+profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/opencl-intel>
   include <abstractions/gtk>

apparmor.d/groups/bus/dbus-daemon

@@ -19,6 +19,7 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
 
   signal (receive) set=(term, kill),
   signal (receive) set=(term, hup) peer=gdm*,
+  signal (send)    set=(term, kill) peer=at-spi-bus-launcher,
 
   network netlink raw,
 

apparmor.d/groups/desktop/at-spi-bus-launcher

@@ -18,7 +18,8 @@ profile at-spi-bus-launcher @{exec_path} {
   deny capability sys_nice,
 
   signal (receive) set=(term hup) peer=gdm*,
-  signal (send) set=(term, kill) peer=dbus-daemon,
+  signal (receive) set=(term hup) peer=dbus-daemon,
+  signal (send)    set=(term, kill) peer=dbus-daemon,
 
   network inet stream,
   network inet6 stream,

apparmor.d/groups/gnome/gnome-shell

@@ -79,6 +79,10 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   owner @{user_share_dirs}/backgrounds/{,**} rw,
   owner @{user_share_dirs}/gnome-shell/{,**} rw,
   owner @{user_share_dirs}/gnome-shell/extensions/{,**} r,
+  owner @{user_share_dirs}/gvfs-metadata/home r,
+  owner @{user_share_dirs}/gvfs-metadata/home-*.log r,
+  owner @{user_share_dirs}/gvfs-metadata/root r,
+  owner @{user_share_dirs}/gvfs-metadata/root-*.log r,
 
   owner @{user_cache_dirs}/evolution/addressbook/*/PHOTO-*.JPEG r,
   owner @{user_cache_dirs}/gnome-photos/{,**} r,

apparmor.d/groups/gnome/gnome-system-monitor

@@ -30,6 +30,11 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
   /usr/share/gnome-system-monitor/{,**} r,
   /usr/share/pixmaps/{,**} r,
 
+  owner @{user_share_dirs}/gvfs-metadata/home r,
+  owner @{user_share_dirs}/gvfs-metadata/home-*.log r,
+  owner @{user_share_dirs}/gvfs-metadata/root r,
+  owner @{user_share_dirs}/gvfs-metadata/root-*.log r,
+
   include <abstractions/dconf>
   owner @{run}/user/@{uid}/dconf/ rw,
   owner @{run}/user/@{uid}/dconf/user rw,

apparmor.d/groups/gvfs/gvfsd-fuse

@@ -7,8 +7,6 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-# DENIED operation="mount" info="failed mntpnt match" error=-13 profile="gvfsd-fuse" name="/home/alex/.cache/gvfs/" comm="gvfsd-fuse" fstype="fuse.gvfsd-fuse" srcname="gvfsd-fuse" flags="rw, nosuid, nodev"
-
 @{exec_path}  = /{usr/,}lib/gvfs/gvfsd-fuse
 @{exec_path} += @{libexec}/gvfsd-fuse
 profile gvfsd-fuse @{exec_path} {

apparmor.d/groups/pacman/pacman

@@ -60,11 +60,13 @@ profile pacman @{exec_path} {
   /{usr/,}bin/glib-compile-schemas        rPx,
   /{usr/,}bin/gtk-query-immodules-{2,3}.0 rPx,
   /{usr/,}bin/install-info                rPx,
+  /{usr/,}bin/journalctl                  rPx,
   /{usr/,}bin/killall                     rPx,
   /{usr/,}bin/pacdiff                     rPx,
   /{usr/,}bin/pacman-key                  rPx,
   /{usr/,}bin/sysctl                      rPx,
   /{usr/,}bin/systemctl                   rPx -> child-systemctl,
+  /{usr/,}bin/systemd-*                   rPx,
   /{usr/,}bin/update-ca-trust             rPx,
   /{usr/,}bin/update-desktop-database     rPx,
   /{usr/,}bin/update-mime-database        rPx,

apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove

@@ -11,6 +11,7 @@ profile pacman-hook-mkinitcpio-remove @{exec_path} {
   include <abstractions/base>
 
   capability dac_read_search,
+  capability mknod,
 
   @{exec_path} mr,
 

apparmor.d/groups/systemd/systemd-backlight

@@ -38,5 +38,5 @@ profile systemd-backlight @{exec_path} flags=(complain) {
 
   /var/lib/systemd/backlight/*backlight* rw,
 
+  include if exists <local/systemd-backlight>
 }
-

apparmor.d/groups/systemd/systemd-coredump

@@ -1,6 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2021 Mikhail Morfikov
-#               2021 Alexandre Pujol <alexandre@pujol.io>
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -8,7 +8,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path}  = /{usr/,}lib/systemd/systemd-coredump
-profile systemd-coredump @{exec_path} flags=(attach_disconnected complain) {
+profile systemd-coredump @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
   include <abstractions/openssl>

apparmor.d/groups/systemd/systemd-detect-virt

@@ -20,5 +20,8 @@ profile systemd-detect-virt @{exec_path} flags=(attach_disconnected) {
   @{sys}/devices/virtual/dmi/id/board_vendor r,
   @{sys}/devices/virtual/dmi/id/bios_vendor r,
 
+  # Inherit silencer
+  deny /apparmor/.null rw,
+
   include if exists <local/systemd-detect-virt>
 }