feat(profiles): general update.

apparmor.d/groups/apt/dpkg-genchanges

@@ -18,6 +18,9 @@ profile dpkg-genchanges @{exec_path} flags=(complain) {
 
   /usr/share/dpkg/cputable r,
   /usr/share/dpkg/tupletable r,
+  /usr/share/lto-disabled-list/lto-disabled-list r,
+
+  /etc/dpkg/origins/* r,
 
   # For package building
   owner @{user_build_dirs}/** rw,

apparmor.d/groups/children/child-dpkg

@@ -2,10 +2,6 @@
 # Copyright (C) 2019-2021 Mikhail Morfikov
 # SPDX-License-Identifier: GPL-2.0-only
 
-# Note: This profile does not specify an attachment path because it is
-# intended to be used only via "Px -> child-dpkg" exec transitions
-# from other profiles. 
-
 # Note: This profile does not specify an attachment path because it is
 # intended to be used only via "Px -> child-dpkg" exec transitions from
 # other profiles. We want to confine the dpkg(1) utility when it

apparmor.d/groups/children/child-open

@@ -56,9 +56,9 @@ profile child-open {
   /usr/share/code/{bin/,}code   rPx,
 
   # Others
+  /{usr/,}bin/*Foliate         rPUx,
   /{usr/,}bin/discord{,-ptb}    rPx,
   /{usr/,}bin/draw.io          rPUx,
-  /{usr/,}bin/*Foliate         rPUx,
   /{usr/,}bin/dropbox           rPx,
   /{usr/,}bin/engrampa          rPx,
   /{usr/,}bin/eog              rPUx,
@@ -68,6 +68,7 @@ profile child-open {
   /{usr/,}bin/geany             rPx,
   /{usr/,}bin/gnome-calculator rPUx,
   /{usr/,}bin/gnome-disk-image-mounter rPx,
+  /{usr/,}bin/gnome-disks       rPx,
   /{usr/,}bin/kgx              rPUx,
   /{usr/,}bin/okular            rPx,
   /{usr/,}bin/qbittorrent       rPx,

apparmor.d/groups/freedesktop/geoclue

@@ -70,6 +70,8 @@ profile geoclue @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
+  /usr/share/glib-2.0/schemas/gschemas.compiled r,
+
   /etc/geoclue/{,**} r,
 
   @{run}/systemd/journal/socket rw,

apparmor.d/groups/freedesktop/xdg-user-dir

@@ -0,0 +1,21 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/xdg-user-dir
+profile xdg-user-dir @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  /{usr/,}bin/{,ba,da}sh             rix,
+  /{usr/,}bin/env                    rix,
+
+  owner @{user_config_dirs}/user-dirs.dirs r,
+
+  include if exists <local/xdg-user-dir>
+}