Update profiles.

apparmor.d/groups/gnome/gnome-control-center

@@ -80,6 +80,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
   @{run}/udev/data/+pci* r,
   @{run}/udev/data/c13:[0-9]* r,    # for /dev/input/*
   @{run}/udev/data/c235:[0-9]* r,
+  @{run}/udev/data/c236:[0-9]* r,
   @{run}/udev/data/n[0-9]* r,
 
   @{sys}/bus/ r,

apparmor.d/groups/gpg/gpg

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2017-2021 Mikhail Morfikov
+#               2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -27,6 +28,9 @@ profile gpg @{exec_path} {
   owner @{HOME}/@{XDG_GPG_DIR}/ rw,
   owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
 
+  owner @{HOME}/@{XDG_PROJECTS_DIR}/**/gnupg/ rw,
+  owner @{HOME}/@{XDG_PROJECTS_DIR}/**/gnupg/** rwkl -> @{HOME}/@{XDG_PROJECTS_DIR}/**/gnupg/**,
+
   owner /var/lib/*/gnupg/ rw,
   owner /var/lib/*/gnupg/** rwkl -> /var/lib/*/gnupg/**,
 

apparmor.d/groups/gpg/gpg-agent

@@ -27,6 +27,18 @@ profile gpg-agent @{exec_path} {
   owner @{HOME}/@{XDG_GPG_DIR}/private-keys-v1.d/[0-9A-F]*.key rw,
   owner @{HOME}/@{XDG_GPG_DIR}/S.gpg-agent{,.ssh,.browser,.extra} rw,
 
+  owner @{HOME}/@{XDG_PROJECTS_DIR}/**/{.,}gnupg/ rw,
+  owner @{HOME}/@{XDG_PROJECTS_DIR}/**/{.,}gnupg/gpg-agent.conf r,
+  owner @{HOME}/@{XDG_PROJECTS_DIR}/**/{.,}gnupg/private-keys-v1.d/ rw,
+  owner @{HOME}/@{XDG_PROJECTS_DIR}/**/{.,}gnupg/private-keys-v1.d/[0-9A-F]*.key rw,
+  owner @{HOME}/@{XDG_PROJECTS_DIR}/**/{.,}gnupg/S.gpg-agent{,.ssh,.browser,.extra} rw,
+
+  owner @{user_tmp_dirs}/**/{.,}gnupg/ rw,
+  owner @{user_tmp_dirs}/**/{.,}gnupg/gpg-agent.conf r,
+  owner @{user_tmp_dirs}/**/{.,}gnupg/private-keys-v1.d/ rw,
+  owner @{user_tmp_dirs}/**/{.,}gnupg/private-keys-v1.d/[0-9A-F]*.key rw,
+  owner @{user_tmp_dirs}/**/{.,}gnupg/S.gpg-agent{,.ssh,.browser,.extra} rw,
+
   owner /var/lib/*/.gnupg/ rw,
   owner /var/lib/*/.gnupg/private-keys-v1.d/ rw,
   owner /var/lib/*/.gnupg/private-keys-v1.d/[0-9A-F]*.key rw,

apparmor.d/groups/systemd/bootctl

@@ -51,7 +51,7 @@ profile bootctl @{exec_path} {
  owner @{PROC}/@{pid}/cgroup r,
        @{PROC}/sys/kernel/random/poolsize r,
 
-  # Silencer
+  # Inherit silencer
   deny network inet6 stream,
   deny network inet stream,
 

apparmor.d/groups/systemd/systemd-detect-virt

@@ -20,9 +20,5 @@ profile systemd-detect-virt @{exec_path} flags=(attach_disconnected) {
   @{sys}/devices/virtual/dmi/id/board_vendor r,
   @{sys}/devices/virtual/dmi/id/bios_vendor r,
 
-  # Silencer
-  deny network inet6 stream,
-  deny network inet stream,
-
   include if exists <local/systemd-detect-virt>
 }

apparmor.d/groups/systemd/systemd-environment-d-generator

@@ -14,9 +14,14 @@ profile systemd-environment-d-generator @{exec_path} {
 
   @{exec_path} mr,
 
+  /{usr/,}bin/gpgconf  rPx,
+  /{usr/,}bin/mawk     rix,
+
   /etc/environment r,
 
   owner @{user_config_dirs}/environment.d/{,*.conf} r,
 
+  /dev/tty rw,
+
   include if exists <local/systemd-environment-d-generator>
 }

apparmor.d/groups/systemd/systemd-hwdb

@@ -19,9 +19,5 @@ profile systemd-hwdb @{exec_path} {
 
   owner @{PROC}/@{pid}/stat r,
 
-  # Silencer
-  deny network inet6 stream,
-  deny network inet stream,
-
   include if exists <local/systemd-hwdb>
 }

apparmor.d/groups/systemd/systemd-sysctl

@@ -27,9 +27,5 @@ profile systemd-sysctl @{exec_path} {
 
   /etc/sysctl.conf r,
 
-  # Silencer
-  deny network inet6 stream,
-  deny network inet stream,
-
   include if exists <local/systemd-sysctl>
 }

apparmor.d/groups/systemd/systemd-sysusers

@@ -37,9 +37,5 @@ profile systemd-sysusers @{exec_path} {
   owner @{PROC}/@{pid}/stat r,
         @{PROC}/sys/kernel/random/boot_id r,
 
-  # Silencer
-  deny network inet6 stream,
-  deny network inet stream,
-
   include if exists <local/systemd-sysusers>
 }

apparmor.d/groups/systemd/systemd-tmpfiles

@@ -13,6 +13,7 @@ profile systemd-tmpfiles @{exec_path} {
   include <abstractions/nameservice-strict>
 
   capability chown,
+  capability dac_override,
   capability dac_read_search,
   capability fowner,
   capability fsetid,
@@ -49,9 +50,5 @@ profile systemd-tmpfiles @{exec_path} {
 
   @{PROC}/@{pid}/net/unix r,
 
-  # Silencer
-  deny network inet6 stream,
-  deny network inet stream,
-
   include if exists <local/systemd-tmpfiles>
 }

apparmor.d/groups/systemd/systemd-udevd

@@ -97,9 +97,5 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
   # file_inherit
   owner @{HOME}/.xsession-errors w,
 
-  # Silencer
-  deny network inet6 stream,
-  deny network inet stream,
-
   include if exists <local/systemd-udevd>
 }

apparmor.d/groups/systemd/systemd-xdg-autostart-generator

@@ -12,6 +12,8 @@ profile systemd-xdg-autostart-generator @{exec_path} {
   include <abstractions/systemd-common>
   include <abstractions/nameservice-strict>
 
+  capability net_admin,
+
   @{exec_path} mr,
 
   /etc/xdg/autostart/{,*.desktop} r,