Update profiles.

apparmor.d/groups/bus/dbus-run-session

@@ -12,6 +12,7 @@ profile dbus-run-session @{exec_path} {
 
   signal (receive) set=term peer=gdm,
   signal (receive) set=(term, kill) peer=gdm-wayland-session,
+  signal (send) set=term peer=dbus-daemon,
 
   @{exec_path} mr,
 

apparmor.d/groups/gnome/gio-launch-desktop

@@ -15,6 +15,7 @@ profile gio-launch-desktop @{exec_path} flags=(attach_disconnected) {
   include <abstractions/app-launcher-user>
   include <abstractions/consoles>
   include <abstractions/freedesktop.org>
+  include <abstractions/nameservice-strict>
   include <abstractions/trash>
 
   @{exec_path} mr,
@@ -33,6 +34,7 @@ profile gio-launch-desktop @{exec_path} flags=(attach_disconnected) {
 
   # Required by many gio command
   owner @{HOME}/{,**} rw,
+  owner /tmp/wl-copy-buffer-*/{,**} rw,
 
   /dev/dri/card[0-9]* rw,
 

apparmor.d/groups/gnome/gnome-session-binary

@@ -35,8 +35,8 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
   /{usr/,}lib/evolution-data-server/evolution-alarm-notify rPx,
   /{usr/,}lib/gsd-*                                        rPx,
 
-  /{usr/,}bin/pkcs11-register                              rUx,
+  /{usr/,}bin/pkcs11-register                              rPx,
-  /{usr/,}bin/start-pulseaudio-x11                         rUx,
+  /{usr/,}bin/start-pulseaudio-x11                         rPx,
 
   /usr/share/applications/org.gnome.Shell.desktop r,
   /usr/share/gdm/greeter-dconf-defaults r,

apparmor.d/groups/gnome/gnome-shell

@@ -92,6 +92,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw,
 
   @{run}/systemd/users/@{uid} r,
+  @{run}/systemd/seats/seat[0-9]* r,
   @{run}/systemd/sessions/ r,
   @{run}/systemd/sessions/[0-9]* r,
   @{run}/systemd/inhibit/[0-9]*.ref rw,

apparmor.d/groups/gnome/tracker-miner

@@ -32,6 +32,8 @@ profile tracker-miner @{exec_path} {
   owner @{user_config_dirs}/tracker3/{,**} rwk,
   owner @{user_cache_dirs}/tracker3/files/{,**} rwk,
 
+  @{PROC}/@{pid}/mountinfo r,
+  @{PROC}/@{pid}/mounts r,
   @{PROC}/sys/fs/inotify/max_user_watches r,
 
   include <abstractions/dconf>

apparmor.d/groups/gpg/dirmngr

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2017-2021 Mikhail Morfikov
+#               2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -10,6 +11,7 @@ include <tunables/global>
 profile dirmngr @{exec_path} {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
+  include <abstractions/p11-kit>
   include <abstractions/ssl_certs>
 
   network inet dgram,
@@ -29,6 +31,7 @@ profile dirmngr @{exec_path} {
 
   owner @{run}/user/@{uid}/gnupg/ rw,
   owner @{run}/user/@{uid}/gnupg/S.dirmngr rw,
+        @{run}/user/@{uid}/d.*/S.dirmngr rw,
 
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,
 

apparmor.d/groups/systemd/coredumpctl

@@ -44,6 +44,7 @@ profile coredumpctl @{exec_path} flags=(complain) {
   profile gdb {
     include <abstractions/base>
     include <abstractions/python>
+    include <abstractions/openssl>
 
     ptrace (trace),
 
@@ -62,6 +63,7 @@ profile coredumpctl @{exec_path} flags=(complain) {
     /usr/share/glib-2.0/gdb/{,**} r,
     /usr/share/gcc-[0-9]*/python/{,**} r,
     /usr/share/gcc/** r,
+    /usr/share/terminfo/x/xterm-256color r,
   
     owner /var/tmp/coredump-* rw,
 

apparmor.d/groups/systemd/systemd-coredump

@@ -15,12 +15,11 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected complain) {
   include <abstractions/systemd-common>
 
   capability dac_read_search,
+  capability net_admin,
   capability setgid,
   capability setpcap,
   capability setuid,
   capability sys_ptrace,
-  # Needed?
-  # deny capability net_admin,
 
   @{exec_path} mr,
 
@@ -31,9 +30,7 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected complain) {
   /etc/systemd/coredump.conf r,
 
   /var/lib/systemd/coredump/ r,
-  /var/lib/systemd/coredump/#[0-9]* rwl,
+  /var/lib/systemd/coredump/** rwl,
-  /var/lib/systemd/coredump/core.*.@{uid}.[0-9a-f]*.[0-9]*.[0-9]*.zst rwl,
-  /var/lib/systemd/coredump/core.*.@{uid}.[0-9a-f]*.[0-9]*.[0-9]* rwl,
 
   owner @{PROC}/@{pid}/setgroups r,
         @{PROC}/@{pids}/comm r,

apparmor.d/profiles-a-l/browserpass

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}bin/browserpass
-profile browserpass @{exec_path} {
+profile browserpass @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
 

apparmor.d/profiles-a-l/git

@@ -75,6 +75,7 @@ profile git @{exec_path} {
   owner @{user_config_dirs}/git/{,*} rw,
 
   /usr/share/git-core/{,**} r,
+  /usr/share/terminfo/x/xterm-256color r,
 
   # For diffs
   owner /tmp/git-difftool.*/ rw,
@@ -91,8 +92,8 @@ profile git @{exec_path} {
   # For package building
   owner @{HOME}/*/                   rw,
   owner @{HOME}/*/**                 rwkl -> @{HOME}/*/**,
-  owner @{user_build_dirs}/**        rwkl -> @{user_build_dirs}/**,
+  owner /tmp/**        rwkl -> /tmp/**,
-  owner @{user_build_dirs}/**/bin/*  rCx -> exec,
+  owner /tmp/**/bin/*  rCx -> exec,
 
   /etc/mailname r,
 

apparmor.d/profiles-m-z/rngd

@@ -1,6 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
-# SPDX-License-Identifier: GPL-3.0-or-later
+# SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
 
@@ -17,6 +17,8 @@ profile rngd @{exec_path} {
   capability sys_nice,
   capability dac_read_search,
 
+  network netlink raw,
+
   /etc/opensc.conf r,
   /etc/conf.d/rngd r,
 
@@ -26,8 +28,12 @@ profile rngd @{exec_path} {
   @{PROC}/sys/kernel/random/poolsize r,
   @{PROC}/sys/kernel/random/write_wakeup_threshold rw,
 
+  /dev/ r,
   /dev/hwrng r,
   /dev/random w,
 
+  @{sys}/bus/ r,
+  @{sys}/class/ r,
+
   include if exists <local/rngd>
 }

apparmor.d/profiles-m-z/virt-manager

@@ -44,6 +44,7 @@ profile virt-manager @{exec_path} {
   /{usr/,}{s,}bin/libvirtd rPx,
 
   /usr/share/virt-manager/{,**} r,
+  /usr/share/virtio/{,*} r,
 
   owner @{HOME}/ r,
   owner @{user_cache_dirs}/ rw,

apparmor.d/profiles-m-z/xdg-mime

@@ -27,6 +27,7 @@ profile xdg-mime @{exec_path} {
   /{usr/,}bin/file       rix,
   /{usr/,}bin/tr         rix,
 
+  /{usr/,}bin/gio        rPx,
   /{usr/,}bin/mimetype   rPx,
   /{usr/,}bin/xprop      rPx,