Improve xorg support in Gnome.

apparmor.d/groups/gnome/gdm-x-session

@@ -10,12 +10,15 @@ include <tunables/global>
 profile gdm-x-session @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
 
-  signal (receive) set=term peer=gdm*,
-  signal (send) set=term peer=unconfined,
+  signal (receive) set=term peer=gdm{,-session-worker},
+  # signal (send) set=term peer=unconfined,
+  signal (send) set=term peer=dbus-run-session,
+  signal (send) set=term peer=xorg,
+  signal (send) set=term peer=gnome-session-binary,
 
   @{exec_path} mr,
 
-  /{usr/,}bin/Xorg              rUx,
+  /{usr/,}bin/Xorg              rPx,
   /{usr/,}bin/dbus-run-session  rPx,
   /etc/gdm/Xsession             rPx,
 

apparmor.d/groups/gnome/gdm-xsession

@@ -16,18 +16,19 @@ profile gdm-xsession @{exec_path} {
   @{exec_path} mr,
 
   /{usr/,}bin/{,ba,da}sh      rix,
-  /{usr/,}bin/zsh             rix,
   /{usr/,}bin/{,e}grep        rix,
   /{usr/,}bin/gnome-session   rix,
   /{usr/,}bin/gsettings       rix,
   /{usr/,}bin/id              rix,
   /{usr/,}bin/tty             rix,
+  /{usr/,}bin/zsh             rix,
 
   /{usr/,}bin/dbus-update-activation-environment    rCx -> dbus,
+  /{usr/,}bin/flatpak                               rPUx,
   /{usr/,}bin/systemctl                             rPx -> child-systemctl,
   /{usr/,}bin/xhost                                 rPx,
   /{usr/,}lib/gnome-session-binary                  rPx,
-  /{usr/,}bin/flatpak                               rPUx,
+  /{usr/,}bin/xbrlapi                               rPx,
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /etc/X11/{,**} r,

apparmor.d/groups/gnome/gjs-console

@@ -15,6 +15,7 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
   include <abstractions/freedesktop.org>
   include <abstractions/gtk>
   include <abstractions/mesa>
+  include <abstractions/opencl-nvidia>
   include <abstractions/openssl>
 
   network netlink raw,
@@ -27,6 +28,7 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
   @{libexec}/** rPUx,
 
   /usr/share/dconf/profile/gdm r,
+  /usr/share/egl/{,**} r,
   /usr/share/gdm/greeter-dconf-defaults r,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /usr/share/glvnd/egl_vendor.d/{,*.json} r,
@@ -54,6 +56,8 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
   owner @{run}/user/@{uid}/gdm/Xauthority r,
         @{run}/user/@{uid}/wayland-cursor-shared-* rw,
 
+  @{sys}/devices/pci[0-9]*/**/drm/ r,
+
   /dev/ r,
   /dev/tty rw,
   /dev/tty[0-9]* rw,