feat(profile): initial support for whonix.

apparmor.d/groups/bus/dbus-daemon

@@ -60,6 +60,8 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
   /usr/share/org.gnome.Characters/org.gnome.Characters                    rPx,
   /usr/share/org.gnome.Characters/org.gnome.Characters.BackgroundService  rPx,
 
+  @{lib}/mate-notification-daemon/mate-notification-daemon rPUx,
+
   @{user_share_dirs}/gnome-shell/extensions/gsconnect@andyholmes.github.io/service/daemon.js rPx,
 
   /etc/dbus-1/{,**} r,

apparmor.d/groups/freedesktop/xrdb

@@ -23,10 +23,10 @@ profile xrdb @{exec_path} {
   @{lib}/llvm-[0-9]*/bin/clang         rix,
 
   /usr/include/stdc-predef.h r,
+
   /usr/etc/X11/xdm/Xresources r,
 
-  @{etc_ro}/X11/Xresources r,
-  @{etc_ro}/X11/Xresources/x11-common r,
+  /etc/X11/Xresources/* r,
 
   # The location of the .Xresources file
   owner @{HOME}/.Xdefaults r,

apparmor.d/groups/grub/update-grub

@@ -11,6 +11,8 @@ profile update-grub @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
 
+  capability dac_read_search,
+
   @{exec_path} mr,
   @{bin}/{,ba,da}sh rix,
   @{bin}/grub-mkconfig rPx,

apparmor.d/groups/systemd/systemd-generator-getty

@@ -21,5 +21,7 @@ profile systemd-generator-getty @{exec_path} flags=(attach_disconnected)  {
 
   @{PROC}/@{pid}/cgroup r,
 
+  owner /dev/ttyS@{int} rw,
+
   include if exists <local/systemd-generator-getty>
 }