feat(profile): general update.

Also include some preparation for the systemd profile.

apparmor.d/groups/freedesktop/colord

@@ -57,8 +57,7 @@ profile colord @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
-  @{lib}/colord/colord-sane  rPx,
-  @{lib}/colord-sane          rPx,
+  @{lib}/{,colord/}colord-sane  rPx,
 
   /etc/machine-id r,
   /etc/udev/hwdb.bin r,
@@ -79,16 +78,18 @@ profile colord @{exec_path} flags=(attach_disconnected) {
 
   @{run}/systemd/sessions/* r,
 
+  @{run}/udev/data/+pci:* r,
   @{run}/udev/data/c81:@{int}  r,         # For video4linux
 
   @{sys}/class/drm/ r,
   @{sys}/class/video4linux/ r,
-  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]/card[0-9]-{HDMI,VGA,LVDS,DP,eDP,Virtual}-*/{enabled,edid} r,
+  @{sys}/devices/@{pci}/drm/card@{int}/card[0-9]-{HDMI,VGA,LVDS,DP,eDP,Virtual}-*/{enabled,edid} r,
+  @{sys}/devices/@{pci}/uevent r,
   @{sys}/devices/virtual/dmi/id/{sys_vendor,product_version,product_name} r,
 
-  owner @{PROC}/@{pid}/fd/ r,
         @{PROC}/@{pids}/cgroup r,
         @{PROC}/@{pids}/cmdline r,
+  owner @{PROC}/@{pid}/fd/ r,
 
   include if exists <local/colord>
 }

apparmor.d/groups/freedesktop/polkitd

@@ -8,7 +8,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = @{lib}/{,polkit-1/}polkitd
-profile polkitd @{exec_path} {
+profile polkitd @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/dbus-strict>
   include <abstractions/nameservice-strict>
@@ -58,8 +58,8 @@ profile polkitd @{exec_path} {
   /usr/share/polkit-1/actions/*.policy r,
   /usr/share/polkit-1/actions/*.policy.choice r,
 
-  owner /var/lib/polkit{,-1}/.cache/ rw,
         /var/lib/polkit{,-1}/localauthority/{,**} r,
+  owner /var/lib/polkit{,-1}/.cache/ rw,
 
   @{run}/systemd/sessions/* r,
   @{run}/systemd/users/@{uid} r,

apparmor.d/groups/freedesktop/update-desktop-database

@@ -34,6 +34,11 @@ profile update-desktop-database @{exec_path} flags=(attach_disconnected) {
   /var/lib/snapd/desktop/applications/.mimeinfo.cache.* rw,
   /var/lib/snapd/desktop/applications/mimeinfo.cache w,
 
+  owner @{user_share_dirs}/.mimeinfo.cache.* rw,
+  owner @{user_share_dirs}/{,**/} r,
+  owner @{user_share_dirs}/**.desktop r,
+  owner @{user_share_dirs}/mimeinfo.cache w,
+
   # Inherit silencer
   deny network inet6 stream,
   deny network inet stream,

apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome

@@ -20,6 +20,7 @@ profile xdg-desktop-portal-gnome @{exec_path} {
   include <abstractions/freedesktop.org>
   include <abstractions/gtk>
   include <abstractions/mesa>
+  include <abstractions/nameservice-strict>
   include <abstractions/nvidia>
   include <abstractions/user-download>
   include <abstractions/vulkan>

apparmor.d/groups/freedesktop/xorg

@@ -22,6 +22,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
   include <abstractions/opencl>
   include <abstractions/vulkan>
 
+  capability dac_override,
   capability dac_read_search,
   capability ipc_owner,
   capability perfmon,
@@ -30,11 +31,6 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
   capability sys_admin,
   capability sys_rawio,
 
-  # These can be denied?
-  #audit capability dac_override,
-  #audit capability sys_nice,
-  #capability sys_tty_config,
-
   signal (send) set=(usr1),
 
   signal (receive) peer=lightdm,