feat(profile): improve integration with opensuse.

apparmor.d/groups/freedesktop/plymouthd

@@ -12,6 +12,8 @@ profile plymouthd @{exec_path} {
   include <abstractions/consoles>
   include <abstractions/dri-common>
 
+  capability checkpoint_restore,
+  capability net_admin,
   capability sys_admin,
   capability sys_chroot,
   capability sys_tty_config,

apparmor.d/groups/freedesktop/xrdb

@@ -24,8 +24,7 @@ profile xrdb @{exec_path} {
 
   /usr/include/stdc-predef.h r,
 
-  /usr/etc/X11/xdm/Xresources r,
-
+  @{etc_ro}/X11/xdm/Xresources r,
   /etc/X11/Xresources/* r,
 
   # The location of the .Xresources file

apparmor.d/groups/freedesktop/xset

@@ -12,6 +12,8 @@ profile xset @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
 
+  capability dac_read_search,
+
   @{exec_path} mr,
 
   owner @{HOME}/.Xauthority r,

apparmor.d/groups/kde/ksplashqml

@@ -16,6 +16,9 @@ profile ksplashqml @{exec_path} {
 
   @{exec_path} mr,
 
+  @{lib}/libheif/            r,
+  @{lib}/libheif/*.so*      rm,
+
   /usr/share/plasma/** r,
 
   /etc/machine-id r,

apparmor.d/groups/kde/sddm

@@ -73,9 +73,14 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   @{bin}/cat           rix,
   @{bin}/checkproc     rix,
   @{bin}/disable-paste rix,
+  @{bin}/locale        rix,
+  @{bin}/manpath       rix,
   @{bin}/pidof         rix,
+  @{bin}/readlink      rix,
+  @{bin}/realpath      rix,
   @{bin}/tr            rix,
   @{bin}/tty           rix,
+  @{bin}/uname         rix,
   @{bin}/xdm           r,
   @{bin}/xmodmap       rix,
 
@@ -117,19 +122,28 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   /{usr/,}etc/security/limits.d/{,*.conf} r,
   /{usr/,}etc/X11/Xmodmap r,
   /etc/debuginfod/{,*} r,
+  /etc/manpath.config r,
   /etc/default/locale r,
   /etc/locale.conf r,
   /etc/machine-id r,
   /etc/sddm.conf r,
   /etc/sddm.conf.d/{,*} r,
   /etc/shells r,
+  /etc/sysconfig/console r,
   /etc/sysconfig/displaymanager r,
+  /etc/sysconfig/language r,
+  /etc/sysconfig/mail r,
+  /etc/sysconfig/proxy r,
+  /etc/sysconfig/windowmanager r,
 
   / r,
 
   /var/lib/lastlog/ r,
   /var/lib/lastlog/* rwk,
 
+  /var/lib/wtmpdb/ r,
+  /var/lib/wtmpdb/* rwk,
+
         /var/lib/sddm/state.conf rw,
   owner /var/lib/sddm/.cache/sddm-greeter/qmlcache/*.jsc mrw,
   owner /var/lib/sddm/.cache/sddm-greeter/qmlcache/*.qmlc mrw,

apparmor.d/groups/ssh/sshd

@@ -72,6 +72,7 @@ profile sshd @{exec_path} flags=(attach_disconnected) {
   @{etc_ro}/environment r,
   @{etc_ro}/security/limits.d/{,*.conf} r,
   @{etc_rw}/motd r,
+  @{etc_rw}/motd.d/{,**} r,
   /etc/default/locale r,
   /etc/gss/mech.d/{,*} r,
   /etc/issue.net r,

apparmor.d/groups/systemd/systemd-logind

@@ -53,8 +53,9 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) {
 
   /etc/machine-id r,
   /etc/systemd/logind.conf r,
-  /etc/systemd/sleep.conf r,
   /etc/systemd/logind.conf.d/{,**} r,
+  /etc/systemd/sleep.conf r,
+  /etc/systemd/sleep.conf.d/{,**} r,
 
   / r,
   /boot/{,**} r,