fix: variour small fixes.

See #409

apparmor.d/groups/gnome/gio-launch-desktop

@@ -3,6 +3,11 @@
 # Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
+# TODO: Rethink this profile:
+# - Access to gio from a profile is handled by child-open-*
+# - Direct access should only be needed is some special context and it should not
+#   require access to that much resources.
+
 abi <abi/3.0>,
 
 include <tunables/global>

apparmor.d/groups/gnome/gsd-color

@@ -21,6 +21,8 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
   include <abstractions/gnome-strict>
   include <abstractions/nameservice-strict>
 
+  network inet stream,
+
   signal (receive) set=(term, hup) peer=gdm*,
 
   #aa:dbus own bus=session name=org.gnome.SettingsDaemon.Color

apparmor.d/groups/gnome/gsd-keyboard

@@ -21,6 +21,8 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
   include <abstractions/gnome-strict>
   include <abstractions/nameservice-strict>
 
+  network inet stream,
+
   signal (receive) set=(term, hup) peer=gdm*,
 
   #aa:dbus own bus=session name=org.gnome.SettingsDaemon.Keyboard

apparmor.d/groups/gnome/gsd-power

@@ -30,6 +30,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
   include <abstractions/gnome-strict>
   include <abstractions/nameservice-strict>
 
+  network inet stream,
   network netlink raw,
 
   signal (receive) set=(term, hup) peer=gdm*,

apparmor.d/groups/gnome/gsd-smartcard

@@ -31,13 +31,17 @@ profile gsd-smartcard @{exec_path} flags=(attach_disconnected) {
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
   /etc/{,opensc/}opensc.conf r,
-
-  owner @{GDM_HOME}/greeter-dconf-defaults r,
-  owner @{gdm_config_dirs}/dconf/user r,
+  /etc/tpm2-tss/* r,
 
   /var/tmp/ r,
   /tmp/ r,
 
+  owner @{GDM_HOME}/.tpm2_pkcs11/tpm2_pkcs11.sqlite3 rw,
+  owner @{GDM_HOME}/greeter-dconf-defaults r,
+  owner @{gdm_config_dirs}/dconf/user r,
+
+  owner @{HOME}/.tpm2_pkcs11/tpm2_pkcs11.sqlite3 rw,
+
   owner /dev/tty@{int} rw,
 
   include if exists <local/gsd-smartcard>