feat(profiles): general update.

apparmor.d/groups/freedesktop/accounts-daemon

@@ -15,6 +15,8 @@ profile accounts-daemon @{exec_path} {
   include <abstractions/wutmp>
 
   capability dac_read_search,
+  capability setgid,
+  capability setuid,
   capability sys_nice,
   capability sys_ptrace,
 
@@ -25,9 +27,10 @@ profile accounts-daemon @{exec_path} {
   /usr/share/accountsservice/{,**} r,
   /usr/share/dbus-1/interfaces/*.xml r,
 
-  /etc/gdm/ r,
-  /etc/gdm/custom.conf rw,
-  /etc/gdm/custom.conf.* rw,
+  /etc/default/locale r,
+  /etc/gdm{3,}/ r,
+  /etc/gdm{3,}/custom.conf rw,
+  /etc/gdm{3,}/custom.conf.* rw,
   /etc/machine-id r,
   /etc/shadow r,
   /etc/shells r,
@@ -35,6 +38,8 @@ profile accounts-daemon @{exec_path} {
   owner /var/lib/AccountsService/ r,
   owner /var/lib/AccountsService/** rw,
 
+  @{HOME}/ r,
+
   @{PROC}/@{pids}/cmdline r,
   @{PROC}/1/environ r,
   @{PROC}/cmdline r,

apparmor.d/groups/freedesktop/at-spi-bus-launcher

@@ -37,7 +37,7 @@ profile at-spi-bus-launcher @{exec_path} flags=(attach_disconnected) {
   owner @{run}/user/@{uid}/dconf/ rw,
   owner @{run}/user/@{uid}/dconf/user rw,
   owner @{run}/user/@{uid}/gdm/Xauthority r,
-  
+
   /var/lib/lightdm/.Xauthority r,
   /var/lib/gdm/.config/dconf/user r,
 

apparmor.d/groups/freedesktop/colord-session

@@ -6,7 +6,8 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-@{exec_path} = /{usr/,}lib/colord/colord-session @{libexec}/colord-session
+@{exec_path} = /{usr/,}lib/colord/colord-session
+@{exec_path} += @{libexec}/colord-session
 profile colord-session @{exec_path} flags=(complain) {
   include <abstractions/base>
 

apparmor.d/groups/freedesktop/pulseaudio

@@ -16,12 +16,17 @@ profile pulseaudio @{exec_path} {
   include <abstractions/dbus-strict>
   include <abstractions/dri-common>
   include <abstractions/dri-enumerate>
+  include <abstractions/gstreamer>
+  include <abstractions/hosts_access>
   include <abstractions/nameservice-strict>
 
   ptrace (trace) peer=@{profile_name},
 
   signal (receive) peer=pacmd,
 
+  unix (send receive connect) type=stream peer=(addr=@/tmp/.X11-unix/*),
+  unix (send receive connect) type=stream peer=(addr=@/tmp/.ICE-unix/*),
+
   network inet stream,
   network inet6 stream,
   network netlink raw,
@@ -29,65 +34,6 @@ profile pulseaudio @{exec_path} {
   network bluetooth stream,
   network bluetooth seqpacket,
 
-  @{exec_path} mrix,
-
-  /{usr/,}lib{exec,}/pulse/gsettings-helper mrix,
-  /{usr/,}lib/@{multiarch}/gstreamer1.0/gstreamer-1.0/gst-plugin-scanner mrix,
-  /{usr/,}lib/@{multiarch}/pulse/gconf-helper mrix,
-
-  # PulseAudio files
-  /usr/share/pulseaudio/{,**} r,
-  /{usr/,}lib/pulse-*/modules/*.so mr,
-
-  # PulseAudio home config files
-  owner @{user_config_dirs}/pulse/{,**} rw,
-  owner @{user_config_dirs}/dconf/user r,
-
-  owner @{user_cache_dirs}/gstreamer-1.0/registry.x86_64.bin r,
-
-  # Needed when PulseAudio is started via the start-pulseaudio-x11 script
-  owner @{HOME}/.Xauthority r,
-
-  # Needed when PulseAudio is started via gdm
-  owner @{run}/user/@{uid}/gdm{[1-9],}/Xauthority r,
-  owner @{run}/user/@{uid}/.mutter-Xwaylandauth.* r,
-  owner @{HOME}/.ICEauthority r,
-
-  # TCP wrap
-  /etc/hosts.{allow,deny} r,
-
-  owner @{run}/user/@{uid}/ rw,
-  owner @{run}/user/@{uid}/pulse/{,*}   rw,
-  owner @{run}/user/@{uid}/pulse/*.lock   k,
-
-  /usr/share/applications/{,**} r,
-  /usr/share/glib-2.0/schemas/gschemas.compiled r,
-
-  @{sys}/bus/ r,
-  @{sys}/class/ r,
-  @{sys}/class/sound/ r,
-  @{sys}/devices/**/sound/**/{uevent,pcm_class} r,
-  @{run}/udev/data/+sound* r,
-  @{run}/udev/data/c116:[0-9]* r, # For ALSA
-
-  @{sys}/devices/virtual/dmi/id/{bios_vendor,board_vendor,sys_vendor} r,
-  @{sys}/devices/system/node/ r,
-  @{sys}/devices/system/node/node[0-9]/meminfo r,
-
-  deny @{sys}/module/apparmor/parameters/enabled r,
-
-  @{run}/systemd/users/@{uid} r,
-
-  owner @{run}/user/@{uid}/dconf/       rw,
-  owner @{run}/user/@{uid}/dconf/user   rw,
-  owner @{run}/user/@{uid}/ICEauthority r,
-  owner @{run}/user/@{uid}/systemd/notify rw,
-
-  owner @{PROC}/@{pids}/fd/ r,
-  owner @{PROC}/@{pids}/stat r,
-  owner @{PROC}/@{pids}/cmdline r,
-
-  # DBus
   dbus (send)
      bus=session
      path=/org/freedesktop/DBus
@@ -139,14 +85,18 @@ profile pulseaudio @{exec_path} {
      member=GetManagedObjects
      peer=(name=org.bluez),
 
-  unix (send receive connect) type=stream peer=(addr=@/tmp/.X11-unix/*),
-  unix (send receive connect) type=stream peer=(addr=@/tmp/.ICE-unix/*),
+  @{exec_path} mrix,
 
-  # The orcexec.* file is JIT compiled code for various GStreamer elements.
-  # If one is blocked the next is used instead.
-  owner @{run}/user/@{uid}/orcexec.* mrw,
-  #owner @{HOME}/orcexec.* mrw,
-  #owner /tmp/orcexec.* mrw,
+  /{usr/,}@{libexec}/pulse/gsettings-helper mrix,
+  /{usr/,}lib/@{multiarch}/pulse/gconf-helper mrix,
+  /{usr/,}lib/pulse-*/modules/*.so mr,
+
+  /usr/share/applications/{,**} r,
+  /usr/share/glib-2.0/schemas/gschemas.compiled r,
+  /usr/share/pulseaudio/{,**} r,
+  /usr/share/ubuntu/applications/{,*} r,
+
+  /var/lib/snapd/desktop/applications/ r,
 
   # For GDM
   owner /var/lib/gdm{[1-9],}/.config/pulse/{,**}  rw,
@@ -164,13 +114,42 @@ profile pulseaudio @{exec_path} {
   owner /var/lib/lightdm/.config/pulse/{,**}  rw,
   owner /var/lib/lightdm/.config/pulse/cookie   k,
 
+  owner @{HOME}/.Xauthority r,
+  owner @{HOME}/.ICEauthority r,
+
+  owner @{user_config_dirs}/pulse/{,**} rw,
+  owner @{user_config_dirs}/dconf/user r,
+
+  owner @{user_cache_dirs}/gstreamer-1.0/registry.x86_64.bin r,
+
+  owner @{run}/user/@{uid}/ rw,
+  owner @{run}/user/@{uid}/.mutter-Xwaylandauth.* r,
+  owner @{run}/user/@{uid}/dconf/ rw,
+  owner @{run}/user/@{uid}/dconf/user rw,
+  owner @{run}/user/@{uid}/gdm{[1-9],}/Xauthority r,
+  owner @{run}/user/@{uid}/ICEauthority r,
+  owner @{run}/user/@{uid}/pulse/{,*} rw,
+  owner @{run}/user/@{uid}/pulse/*.lock k,
+  owner @{run}/user/@{uid}/systemd/notify rw,
+
+  @{run}/systemd/users/@{uid} r,
+
+  @{run}/udev/data/+sound* r,
+  @{run}/udev/data/c116:[0-9]* r, # For ALSA
+
+  @{sys}/class/sound/ r,
+  @{sys}/devices/**/sound/**/{uevent,pcm_class} r,
+  @{sys}/devices/virtual/dmi/id/{bios_vendor,board_vendor,sys_vendor} r,
+
+  deny @{sys}/module/apparmor/parameters/enabled r,
+
+  owner @{PROC}/@{pids}/fd/ r,
+  owner @{PROC}/@{pids}/stat r,
+  owner @{PROC}/@{pids}/cmdline r,
+
   # file_inherit
   owner /dev/tty[0-9]* rw,
   owner @{HOME}/.xsession-errors w,
 
-  # Snap
-  /var/lib/snapd/desktop/applications/ r,
-  /usr/{local/,}share/ubuntu/applications/{,*} r,
-
   include if exists <local/pulseaudio>
 }

apparmor.d/groups/freedesktop/xdg-desktop-portal

@@ -28,7 +28,6 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
 
   / r,
   /.flatpak-info r,
-  /{usr/,}lib/x r,
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /usr/share/pipewire/client.conf r,

apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome

@@ -10,6 +10,7 @@ include <tunables/global>
 profile xdg-desktop-portal-gnome @{exec_path} {
   include <abstractions/base>
   include <abstractions/dconf>
+  include <abstractions/fontconfig-cache-write>
   include <abstractions/fonts>
   include <abstractions/freedesktop.org>
   include <abstractions/gtk>