Profiles update.

apparmor.d/groups/browsers/firefox

@@ -151,6 +151,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
        @{sys}/class/ r,
        @{sys}/class/**/ r,
        @{sys}/devices/**/uevent r,
+       @{sys}/devices/pci[0-9]*/**/irq r,
        @{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r,
   deny @{sys}/devices/system/cpu/cpu[0-9]/cache/index[0-9]/size r,
   deny @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,

apparmor.d/groups/bus/dbus-run-session

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}bin/dbus-run-session
 profile dbus-run-session @{exec_path} {
   include <abstractions/base>
+  include <abstractions/dconf>
 
   signal (receive) set=term peer=gdm,
   signal (receive) set=(term, kill) peer=gdm-*-session,
@@ -23,11 +24,10 @@ profile dbus-run-session @{exec_path} {
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /usr/share/gdm/greeter-dconf-defaults r,
+  /usr/share/dconf/profile/gdm r,
 
-  include <abstractions/dconf>
   owner @{run}/user/@{uid}/dconf/ rw,
   owner @{run}/user/@{uid}/dconf/user rw,
-  /usr/share/dconf/profile/gdm r,
   /var/lib/gdm/.config/dconf/user r,
 
   owner @{PROC}/@{pid}/fd/ r,

apparmor.d/groups/desktop/at-spi-bus-launcher

@@ -9,11 +9,11 @@ include <tunables/global>
 
 @{exec_path}  = /{usr/,}lib/at-spi2-core/at-spi-bus-launcher
 @{exec_path} += @{libexec}/at-spi-bus-launcher
-profile at-spi-bus-launcher @{exec_path} {
+profile at-spi-bus-launcher @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/dconf>
   include <abstractions/nameservice-strict>
 
-
   signal (receive) set=(term hup kill) peer=dbus-daemon,
   signal (receive) set=(term hup kill) peer=gdm*,
   signal (send)    set=(term hup kill) peer=dbus-daemon,
@@ -26,28 +26,27 @@ profile at-spi-bus-launcher @{exec_path} {
   /{usr/,}bin/dbus-daemon         rPx,
   /{usr/,}bin/dbus-broker-launch rPUx,
 
-  owner @{PROC}/@{pid}/fd/ r,
-  owner @{PROC}/@{pid}/cgroup r,
-
-  owner @{HOME}/.Xauthority r,
-  /var/lib/lightdm/.Xauthority r,
-  owner @{run}/user/@{uid}/gdm/Xauthority r,
-
+  /usr/share/gdm/greeter-dconf-defaults r,
+  /usr/share/dconf/profile/gdm r,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
-  include <abstractions/dconf>
+  owner @{HOME}/.Xauthority r,
+  owner @{HOME}/.xsession-errors w,
+
   owner @{run}/user/@{uid}/dconf/ rw,
   owner @{run}/user/@{uid}/dconf/user rw,
-  /usr/share/dconf/profile/gdm r,
+  owner @{run}/user/@{uid}/gdm/Xauthority r,
+  
+  /var/lib/lightdm/.Xauthority r,
   /var/lib/gdm/.config/dconf/user r,
 
-  # file_inherit
-  owner /dev/tty[0-9]* rw,
-  owner @{HOME}/.xsession-errors w,
   /var/log/lightdm/seat[0-9]*-greeter.log w,
-  /usr/share/gdm/greeter-dconf-defaults r,
 
-  @{PROC}/1/cgroup r,
+  owner @{PROC}/@{pid}/cgroup r,
+  owner @{PROC}/@{pid}/fd/ r,
+        @{PROC}/1/cgroup r,
+
+  owner /dev/tty[0-9]* rw,  # file_inherit
 
   include if exists <local/at-spi-bus-launcher>
 }

apparmor.d/groups/gnome/gdm-xsession

@@ -26,9 +26,9 @@ profile gdm-xsession @{exec_path} {
   /{usr/,}bin/dbus-update-activation-environment    rCx -> dbus,
   /{usr/,}bin/flatpak                               rPUx,
   /{usr/,}bin/systemctl                             rPx -> child-systemctl,
+  /{usr/,}bin/xbrlapi                               rPx,
   /{usr/,}bin/xhost                                 rPx,
   /{usr/,}lib/gnome-session-binary                  rPx,
-  /{usr/,}bin/xbrlapi                               rPx,
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /etc/X11/{,**} r,

apparmor.d/groups/gnome/gnome-control-center

@@ -93,6 +93,8 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
   @{sys}/devices/platform/**/uevent r,
   @{sys}/devices/virtual/**/uevent r,
   @{sys}/devices/pci[0-9]*/**/drm/ r,
+  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/id r,
+  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/gt_*_mhz r,
   @{sys}/devices/virtual/dmi/id/chassis_type r,
   @{sys}/devices/virtual/thermal/thermal_zone[0-9]/hwmon[0-9]/temp* r,
 

apparmor.d/groups/gnome/gnome-control-center-print-renderer

@@ -37,6 +37,10 @@ profile gnome-control-center-print-renderer @{exec_path} {
   owner @{run}/user/@{uid}/dconf/ rw,
   owner @{run}/user/@{uid}/dconf/user rw,
 
+  @{sys}/devices/pci[0-9]*/**/drm/ r,
+  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/id r,
+  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/gt_*_mhz r,
+
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/comm r,
         @{PROC}/sys/dev/i915/perf_stream_paranoid r,

apparmor.d/groups/gnome/gnome-shell

@@ -89,6 +89,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   owner @{user_share_dirs}/gvfs-metadata/{,*} r,
 
   owner @{user_cache_dirs}/evolution/addressbook/*/PHOTO-*.JPEG r,
+  owner @{user_cache_dirs}/gnome-boxes/*.png r,
   owner @{user_cache_dirs}/gnome-photos/{,**} r,
   owner @{user_cache_dirs}/gnome-screenshot/{,**} rw,
   owner @{user_cache_dirs}/libgweather/{,**} r,
@@ -150,6 +151,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   @{sys}/devices/pci[0-9]*/**/input[0-9]*/{properties,name} r,
   @{sys}/devices/pci[0-9]*/**/net/*/statistics/{rx_bytes,tx_bytes} r,
   @{sys}/devices/pci[0-9]*/**/drm/ r,
+  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/gt_*_mhz r,
+  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/id r,
 
   owner @{PROC}/@{pid}/comm r,
   owner @{PROC}/@{pid}/fd/ r,

apparmor.d/groups/gnome/nautilus

@@ -10,6 +10,7 @@ include <tunables/global>
 profile nautilus @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/app-launcher-user>
+  include <abstractions/dconf>
   include <abstractions/gnome>
   include <abstractions/nameservice-strict>
   include <abstractions/openssl>
@@ -40,7 +41,6 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
   deny /tmp/.* rw,
   deny /tmp/.*/ rw,
 
-  include <abstractions/dconf>
   owner @{run}/user/@{uid}/dconf/ rw,
   owner @{run}/user/@{uid}/dconf/user rw,
 

apparmor.d/groups/gpg/dirmngr

@@ -1,6 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2017-2021 Mikhail Morfikov
-#               2021 Alexandre Pujol <alexandre@pujol.io>
+# Copyright (C) 2017-2022 Mikhail Morfikov
+# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -21,13 +21,19 @@ profile dirmngr @{exec_path} {
 
   @{exec_path} mr,
 
+  /usr/share/gnupg/sks-keyservers.netCA.pem r,
+
   owner @{HOME}/@{XDG_GPG_DIR}/ rw,
   owner @{HOME}/@{XDG_GPG_DIR}/dirmngr.conf r,
   owner @{HOME}/@{XDG_GPG_DIR}/dirmngr_ldapservers.conf r,
   owner @{HOME}/@{XDG_GPG_DIR}/crls.d/ rw,
   owner @{HOME}/@{XDG_GPG_DIR}/crls.d/DIR.txt rw,
 
-  /usr/share/gnupg/sks-keyservers.netCA.pem r,
+  owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/ rw,
+  owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/dirmngr.conf r,
+  owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/dirmngr_ldapservers.conf r,
+  owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/crls.d/ rw,
+  owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/crls.d/DIR.txt rw,
 
   owner @{run}/user/@{uid}/gnupg/ rw,
   owner @{run}/user/@{uid}/gnupg/S.dirmngr rw,

apparmor.d/groups/gpg/gpg-agent

@@ -29,12 +29,12 @@ profile gpg-agent @{exec_path} {
   owner @{HOME}/@{XDG_GPG_DIR}/S.gpg-agent{,.ssh,.browser,.extra} rw,
   owner @{HOME}/@{XDG_GPG_DIR}/sshcontrol r,
 
-  owner @{MOUNTS}/*/@{XDG_GPG_DIR}/ rw,
-  owner @{MOUNTS}/*/@{XDG_GPG_DIR}/gpg-agent.conf r,
-  owner @{MOUNTS}/*/@{XDG_GPG_DIR}/private-keys-v1.d/ rw,
-  owner @{MOUNTS}/*/@{XDG_GPG_DIR}/private-keys-v1.d/[0-9A-F]*.key rw,
-  owner @{MOUNTS}/*/@{XDG_GPG_DIR}/S.gpg-agent{,.ssh,.browser,.extra} rw,
-  owner @{MOUNTS}/*/@{XDG_GPG_DIR}/sshcontrol r,
+  owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/ rw,
+  owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/gpg-agent.conf r,
+  owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/private-keys-v1.d/ rw,
+  owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/private-keys-v1.d/[0-9A-F]*.key rw,
+  owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/S.gpg-agent{,.ssh,.browser,.extra} rw,
+  owner @{MOUNTS}/*{,/*}/@{XDG_GPG_DIR}/sshcontrol r,
 
   owner @{HOME}/@{XDG_PROJECTS_DIR}/**/{.,}gnupg/ rw,
   owner @{HOME}/@{XDG_PROJECTS_DIR}/**/{.,}gnupg/gpg-agent.conf r,

apparmor.d/groups/gpg/scdaemon

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2017-2021 Mikhail Morfikov
+# Copyright (C) 2017-2022 Mikhail Morfikov
+# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -21,6 +22,7 @@ profile scdaemon @{exec_path} {
   owner @{HOME}/@{XDG_GPG_DIR}/reader_0.status rw,
 
   owner @{run}/user/@{uid}/gnupg/S.scdaemon rw,
+  owner @{run}/user/@{uid}/gnupg/d.*/S.scdaemon rw,
 
   @{PROC}/@{pid}/task/@{tid}/comm rw,
 

apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2021 Mikhail Morfikov
+# Copyright (C) 2021-2022 Mikhail Morfikov
+# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -10,10 +11,11 @@ include <tunables/global>
 @{exec_path} += @{libexec}/gvfs-udisks2-volume-monitor
 profile gvfs-udisks2-volume-monitor @{exec_path} {
   include <abstractions/base>
+  include <abstractions/dconf>
+  include <abstractions/devices-usb>
+  include <abstractions/disks-read>
   include <abstractions/freedesktop.org>
   include <abstractions/nameservice-strict>
-  include <abstractions/disks-read>
-  include <abstractions/devices-usb>
 
   network inet stream,
   network inet6 stream,
@@ -28,33 +30,31 @@ profile gvfs-udisks2-volume-monitor @{exec_path} {
   /{usr/,}bin/mount  rPx,
   /{usr/,}bin/umount rPx,
 
-  include <abstractions/dconf>
-  owner @{run}/user/@{uid}/dconf/ w,
-  owner @{run}/user/@{uid}/dconf/user rw,
-
-  @{run}/systemd/sessions/[0-9]* r,
+  /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
+  / r,
   /etc/fstab r,
   /etc/machine-id r,
 
   # Mount points
-  @{MOUNTS}/*/ r,
-  @{MOUNTS}/*/**/ r,
-  @{HOME}/*/*/ r,
-  @{HOME}/*/*/**/ r,
-  @{HOME}/bluetooth/ r,
+  owner @{MOUNTS}/*/ r,
+  owner @{MOUNTS}/*/**/ r,
+  owner @{HOME}/*/*/ r,
+  owner @{HOME}/*/*/**/ r,
+  owner @{HOME}/bluetooth/ r,
 
-  / r,
-
-  /usr/share/glib-2.0/schemas/gschemas.compiled r,
+  owner @{run}/user/@{uid}/dconf/ w,
+  owner @{run}/user/@{uid}/dconf/user rw,
 
   @{run}/mount/utab r,
+  @{run}/systemd/sessions/[0-9]* r,
 
-        @{PROC}/ r,
+  owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mountinfo r,
   owner @{PROC}/@{pid}/mounts r,
-  owner @{PROC}/@{pid}/cgroup r,
+  owner @{PROC}/@{pid}/stat r,
+        @{PROC}/ r,
         @{PROC}/1/cgroup r,
         @{PROC}/locks r,
 

apparmor.d/groups/pacman/pacman

@@ -68,7 +68,7 @@ profile pacman @{exec_path} {
   /{usr/,}bin/archlinux-java              rPx,
   /{usr/,}bin/bootctl                     rPx,
   /{usr/,}bin/dconf                       rPx,
-  /{usr/,}bin/fc-cache                    rPx,
+  /{usr/,}bin/fc-cache{,-32}              rPx,
   /{usr/,}bin/gdk-pixbuf-query-loaders    rPx,
   /{usr/,}bin/glib-compile-schemas        rPx,
   /{usr/,}bin/groupadd                    rPx,

apparmor.d/groups/pacman/pacman-hook-systemd

@@ -24,7 +24,7 @@ profile pacman-hook-systemd @{exec_path} {
   /{usr/,}bin/systemd-sysusers       rPx,
   /{usr/,}bin/systemd-tmpfiles       rPx,
   /{usr/,}bin/udevadm                rPx,
-  /{usr/,}lib/systemd-binfmt         rPx,
+  /{usr/,}lib/systemd/systemd-binfmt rPx,
   /{usr/,}lib/systemd/systemd-sysctl rPx,
 
   /usr/ rw,

apparmor.d/groups/systemd/systemd-shutdown

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2020-2021 Mikhail Morfikov
+# Copyright (C) 2020-2022 Mikhail Morfikov
+# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -11,9 +12,10 @@ profile systemd-shutdown @{exec_path} flags=(complain) {
   include <abstractions/base>
   include <abstractions/systemd-common>
 
-  capability sys_resource,
-  capability sys_boot,
   capability kill,
+  capability sys_boot,
+  capability sys_ptrace,
+  capability sys_resource,
 
   signal (send) set=(stop, cont, term, kill),