Profiles update.

apparmor.d/profiles-s-z/syncthing

@@ -1,20 +1,18 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2020-2021 Mikhail Morfikov
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
 
 include <tunables/global>
 
-@{SYNC_DIR}  = @{HOME}/Sync/
-@{SYNC_DIR} += @{MOUNTS}/*/syncthing/
-
 @{exec_path} = /{usr/,}bin/syncthing
 profile syncthing @{exec_path} {
   include <abstractions/base>
+  include <abstractions/deny-root-dir-access>
   include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>
 
   network inet dgram,
   network inet6 dgram,
@@ -27,21 +25,20 @@ profile syncthing @{exec_path} {
   /{usr/,}bin/xdg-open  rCx -> open,
   /{usr/,}bin/ip        rix,
 
-  owner @{HOME}/ r,
-  owner @{user_config_dirs}/syncthing/ rw,
-  owner @{user_config_dirs}/syncthing/** rwk,
-
-  @{SYNC_DIR}/{,**} rw,
+  /usr/share/mime/{,*} r,
 
   /etc/mime.types r,
 
-  @{PROC}/sys/net/core/somaxconn r,
+  owner @{user_config_dirs}/syncthing/{,**} rwk,
+  owner @{HOME}/@{XDG_DATA_HOME}/syncthing/{,**} rwk,
+
+  @{HOME}/ r,
+  @{user_sync_dirs}/{,**} rw,
 
   @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
 
-  # Silecne the noise
-  deny /etc/ssl/certs/java/ r,
-
+  @{PROC}/sys/net/core/somaxconn r,
+  @{PROC}/@{pids}/net/route r,
 
   profile open {
     include <abstractions/base>
@@ -55,15 +52,14 @@ profile syncthing @{exec_path} {
     /{usr/,}bin/basename        rix,
 
     owner @{HOME}/ r,
-
     owner @{run}/user/@{uid}/ r,
 
     # Allowed apps to open
-    /{usr/,}lib/firefox/firefox rPUx,
+    /{usr/,}bin/firefox          rPx,
+    /{usr/,}lib/firefox/firefox  rPx,
 
     # file_inherit
     owner @{HOME}/.xsession-errors w,
-
   }
 
   include if exists <local/syncthing>