feat(profile): general update.

apparmor.d/profiles-s-z/sulogin

@@ -15,14 +15,16 @@ profile sulogin @{exec_path} {
 
   @{exec_path} mr,
 
-  @{bin}/{,ba,da}sh  rux,
+  # The shell is not confined on purpose.
+  @{bin}/{,b,d,rb}ash         rUx,
+  @{bin}/{c,k,tc,z}sh         rUx,
 
   /etc/shadow r,
 
+  @{PROC}/consoles r,
+
   /dev/ r,
   /dev/tty@{int} rw,
 
-  @{PROC}/consoles r,
-
   include if exists <local/sulogin>
 }

apparmor.d/profiles-s-z/syncthing

@@ -21,7 +21,7 @@ profile syncthing @{exec_path} {
 
   @{exec_path} mrix,
 
-  @{bin}/xdg-open  rCx -> open,
+  @{bin}/xdg-open  rPx -> child-open,
   @{bin}/ip        rix,
 
   /usr/share/mime/{,*} r,
@@ -41,27 +41,5 @@ profile syncthing @{exec_path} {
   @{PROC}/sys/net/core/somaxconn r,
   @{PROC}/@{pids}/net/route r,
 
-  profile open {
-    include <abstractions/base>
-    include <abstractions/xdg-open>
-
-    @{bin}/xdg-open mr,
-
-    @{bin}/{,ba,da}sh      rix,
-    @{bin}/{m,g,}awk       rix,
-    @{bin}/readlink        rix,
-    @{bin}/basename        rix,
-
-    owner @{HOME}/ r,
-    owner @{run}/user/@{uid}/ r,
-
-    # Allowed apps to open
-    @{bin}/firefox          rPx,
-    @{lib}/firefox/firefox  rPx,
-
-    # file_inherit
-    owner @{HOME}/.xsession-errors w,
-  }
-
   include if exists <local/syncthing>
 }

apparmor.d/profiles-s-z/w

@@ -1,6 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2021 Mikhail Morfikov
-#               2021 Alexandre Pujol <alexandre@pujol.io>
+# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -23,12 +23,15 @@ profile w @{exec_path} {
   @{sys}/devices/system/node/ r,
   @{sys}/devices/system/node/node@{int}/meminfo r,
 
+  @{run}/systemd/sessions/ r,
+  @{run}/systemd/sessions/@{int} r,
+
   @{PROC}/ r,
-  @{PROC}/uptime r,
-  @{PROC}/sys/kernel/osrelease r,
-  @{PROC}/loadavg r,
-  @{PROC}/@{pids}/stat r,
   @{PROC}/@{pids}/cmdline r,
+  @{PROC}/@{pids}/stat r,
+  @{PROC}/loadavg r,
+  @{PROC}/sys/kernel/osrelease r,
+  @{PROC}/uptime r,
 
   include if exists <local/w>
 }