feat(profiles): general update.

apparmor.d/profiles-s-z/snapd

@@ -39,8 +39,8 @@ profile snapd @{exec_path} {
   network inet6 dgram,
   network netlink raw,
 
-  mount fstype=squashfs /dev/loop[0-9]* -> /tmp/syscheck-mountpoint-[0-9]*/,
-  umount /tmp/syscheck-mountpoint-[0-9]*/,
+  mount fstype=squashfs /dev/loop@{int} -> /tmp/syscheck-mountpoint-@{int}/,
+  umount /tmp/syscheck-mountpoint-@{int}/,
   umount /snap/*/*/,
 
   ptrace (read) peer=snap,

apparmor.d/profiles-s-z/sudo

@@ -37,7 +37,7 @@ profile sudo @{exec_path} {
 
   signal (send) peer=unconfined,
   signal (send) set=(cont,hup) peer=su,
-  signal (send) set=winch peer={apt,zsysd,zsys-system-autosnapshot},
+  signal (send) set=winch peer={apt,zsysd,zsys-system-autosnapshot,pacman},
   signal (send,receive) peer=cockpit-bridge,
 
   dbus send bus=system path=/org/freedesktop/login[0-9]

apparmor.d/profiles-s-z/thunderbird-vaapitest

@@ -9,6 +9,7 @@ include <tunables/global>
 @{name} = thunderbird{,-bin}
 @{lib_dirs} = @{lib}/@{name}
 @{config_dirs} = @{HOME}/.@{name}/
+@{cache_dirs} = @{user_cache_dirs}/@{name}/
 
 @{exec_path} = @{lib_dirs}/vaapitest
 profile thunderbird-vaapitest @{exec_path} {
@@ -29,6 +30,7 @@ profile thunderbird-vaapitest @{exec_path} {
 
   @{sys}/devices/@{pci}/{irq,resource,revision} r,
 
+  deny @{cache_dirs}/*/startupCache/** r,
   deny @{config_dirs}/*/.parentlock rw,
   deny @{config_dirs}/*/startupCache/** r,
 

apparmor.d/profiles-s-z/udisksd

@@ -123,6 +123,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
   /var/lib/udisks2/mounted-fs{,*} rw,
 
   # Be able to create/delete dirs for removable media
+  @{MOUNTDIRS}/ rw,
   @{MOUNTS}/ rw,
   @{MOUNTS}/*/ rw,
 

apparmor.d/profiles-s-z/userdel

@@ -20,10 +20,10 @@ profile userdel @{exec_path} flags=(attach_disconnected) {
   capability fsetid,
   capability sys_ptrace,
 
-  ptrace (read),
-
   network netlink raw,
 
+  ptrace (read),
+
   @{exec_path} mr,
 
   /etc/login.defs r,

apparmor.d/profiles-s-z/usermod

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -12,31 +13,23 @@ profile usermod @{exec_path} flags=(attach_disconnected) {
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
 
-  # To write records to the kernel auditing log.
   capability audit_write,
-
-  # To set the right permission to the files in the /etc/ dir.
   capability chown,
-  capability fsetid,
-
-  # To read user home files and change their user/group.
-  #  usermod: Failed to change ownership of the home directory
   capability dac_read_search,
-
-  # To move user home files to a new location.
   capability fowner,
-
-  # To prevent removing a user when it's used by some process.
+  capability fsetid,
   capability sys_ptrace,
-  ptrace (read),
 
   network netlink raw,
 
+  ptrace (read),
+
   @{exec_path} mr,
 
   @{bin}/nscd rix,
 
   /etc/login.defs r,
+  /etc/subuid r,
 
   /etc/{passwd,shadow,gshadow,group} rw,
   /etc/{passwd,shadow,gshadow,group}.@{pid} w,
@@ -52,16 +45,14 @@ profile usermod @{exec_path} flags=(attach_disconnected) {
   # modify the /etc/passwd or /etc/shadow password database.
   /etc/.pwd.lock rwk,
 
-  /etc/subuid r,
-
-  @{PROC}/ r,
-  @{PROC}/@{pids}/task/ r,
-
   # To create and move user dirs
   @{HOME}/{,**}    rw,
   /var/            r,
   /var/lib/        r,
   /var/lib/*/{,**} rw,
 
+  @{PROC}/ r,
+  @{PROC}/@{pids}/task/ r,
+
   include if exists <local/usermod>
 }

apparmor.d/profiles-s-z/vlc

@@ -21,6 +21,7 @@ profile vlc @{exec_path} {
   include <abstractions/freedesktop.org>
   include <abstractions/gtk>
   include <abstractions/ibus>
+  include <abstractions/mesa>
   include <abstractions/nameservice-strict>
   include <abstractions/opencl>
   include <abstractions/ssl_certs>

apparmor.d/profiles-s-z/warzone2100

@@ -1,48 +0,0 @@
-# apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2021 Mikhail Morfikov
-# SPDX-License-Identifier: GPL-2.0-only
-
-abi <abi/3.0>,
-
-include <tunables/global>
-
-@{exec_path} = @{bin}/warzone2100
-profile warzone2100 @{exec_path} {
-  include <abstractions/base>
-  include <abstractions/X>
-  include <abstractions/freedesktop.org>
-  include <abstractions/vulkan>
-  include <abstractions/mesa>
-  include <abstractions/dri-enumerate>
-  include <abstractions/nameservice-strict>
-  include <abstractions/audio>
-
-  network inet dgram,
-  network inet6 dgram,
-  network inet stream,
-  network inet6 stream,
-  network netlink raw,
-
-  deny ptrace (read),
-
-  @{exec_path} mr,
-
-  @{bin}/{,ba,da}sh   rix,
-  @{bin}/which{,.debianutils}        rix,
-
-  owner @{user_share_dirs}/warzone2100-*/ rw,
-  owner @{user_share_dirs}/warzone2100-*/** rw,
-
-  # What's this for?
-  deny owner @{user_share_dirs}/applications/*.desktop w,
-
-  /usr/share/warzone2100/{,**} r,
-
-  /var/lib/dbus/machine-id r,
-  /etc/machine-id r,
-
-  deny @{PROC}/@{pids}/cmdline r,
-       @{PROC}/@{pids}/stat r,
-
-  include if exists <local/warzone2100>
-}