feat(profile): general update.

apparmor.d/profiles-s-z/speedtest

@@ -12,6 +12,7 @@ profile speedtest @{exec_path} {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
+  include <abstractions/python>
 
   network inet dgram,
   network inet6 dgram,
@@ -26,12 +27,10 @@ profile speedtest @{exec_path} {
   @{bin}/file  rix,
   @{bin}/uname rix,
 
-  owner @{PROC}/@{pid}/fd/ r,
-
-  /usr/local/lib/python*/dist-packages/ r,
-
   /etc/magic r,
 
+  owner @{PROC}/@{pid}/fd/ r,
+
   include if exists <local/speedtest>
 }
 

apparmor.d/profiles-s-z/spice-client-glib-usb-acl-helper

@@ -17,10 +17,8 @@ profile spice-client-glib-usb-acl-helper @{exec_path} {
 
   @{exec_path} mr,
 
-  @{lib}/gconv/gconv-modules r,
-
-  owner @{PROC}/@{pid}/stat r,
         @{PROC}/sys/kernel/cap_last_cap r,
+  owner @{PROC}/@{pid}/stat r,
 
   include if exists <local/spice-client-glib-usb-acl-helper>
 }

apparmor.d/profiles-s-z/ss

@@ -16,7 +16,7 @@ profile ss @{exec_path} {
   capability dac_read_search,
   capability sys_ptrace,
 
-  ptrace (read),  # unconfined, TODO
+  ptrace read,
 
   network netlink raw,
 
@@ -27,21 +27,20 @@ profile ss @{exec_path} {
   owner @{tmp}/*.ss     rw,
   owner @{HOME}/*.ss  rw,
 
+  @{sys}/fs/cgroup/{,**/} r,
+
         @{PROC} r,
-        @{PROC}/sys/net/ipv{4,6}/ip_local_port_range r,
+        @{PROC}/@{pids}/attr/current r,
         @{PROC}/@{pids}/fd/ r,
         @{PROC}/@{pids}/stat r,
-        @{PROC}/@{pids}/attr/current r,
-  owner @{PROC}/@{pids}/net/sockstat r,
-  owner @{PROC}/@{pids}/net/snmp r,
-  owner @{PROC}/@{pids}/net/unix r,
+        @{PROC}/sys/net/ipv{4,6}/ip_local_port_range r,
+  owner @{PROC}/@{pids}/mounts r,
   owner @{PROC}/@{pids}/net/raw r,
+  owner @{PROC}/@{pids}/net/snmp r,
+  owner @{PROC}/@{pids}/net/sockstat r,
   owner @{PROC}/@{pids}/net/tcp r,
   owner @{PROC}/@{pids}/net/udp r,
-
-  # [e]xtended
-  owner @{PROC}/@{pids}/mounts r,
-        @{sys}/fs/cgroup/{,**/} r,
+  owner @{PROC}/@{pids}/net/unix r,
 
   include if exists <local/ss>
 }

apparmor.d/profiles-s-z/steam

@@ -54,7 +54,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   ptrace read,
   ptrace trace peer=steam,
 
-  signal send peer=steam-game,
+  signal send peer=steam-game-{native,proton},
   signal send peer=steam-launcher,
   signal send peer=steam//journalctl,
   signal send peer=steam//web,

apparmor.d/profiles-s-z/steam-launch

@@ -34,7 +34,7 @@ profile steam-launch @{exec_path} {
   @{lib}/steam/bin_steam.sh  rix,
   @{share_dirs}/steam.sh     rPx,
 
-  @{runtime_dirs}/@{arch}/steam-runtime-steam-remote rPUx,
+  @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-steam-remote rPx,
 
   /usr/ r,
   /usr/local/ r,

apparmor.d/profiles-s-z/steam-runtime-steam-remote

@@ -0,0 +1,29 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{arch} = amd64 i386
+@{runtime} = SteamLinuxRuntime_sniper
+@{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation
+@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} @{share_dirs}/linux{32,64}
+@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper}
+@{app_dirs} = @{share_dirs}/steamapps/common/
+
+@{exec_path} = @{runtime_dirs}/@{arch}/@{bin}/steam-runtime-steam-remote
+profile steam-runtime-steam-remote @{exec_path} flags=(complain) {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  @{runtime_dirs}/** rm,
+
+  owner @{HOME}/.steam/steam.pipe rw,
+
+  include if exists <local/steam-runtime-steam-remote>
+}
+
+# vim:syntax=apparmor

apparmor.d/profiles-s-z/uname

@@ -17,7 +17,8 @@ profile uname @{exec_path} flags=(attach_disconnected) {
   /dev/tty@{int} rw,
 
   deny network,
-  deny @{user_share_dirs}/gvfs-metadata/* r,
+  deny owner @{user_share_dirs}/gvfs-metadata/* r,
+  deny owner @{user_share_dirs}/zed/**/data.mdb rw,
 
   include if exists <local/uname>
 }

apparmor.d/profiles-s-z/vipw-vigr

@@ -35,7 +35,6 @@ profile vipw-vigr @{exec_path} {
   # modify the /etc/passwd or /etc/shadow password database.
   /etc/.pwd.lock rwk,
 
-
   profile editor {
     include <abstractions/base>
     include <abstractions/app/editor>
@@ -43,6 +42,8 @@ profile vipw-vigr @{exec_path} {
     capability fsetid,
 
     /etc/{passwd,shadow,gshadow,group}.edit rw,
+
+    include if exists <local/vipw-vigr_editor>
   }
 
   include if exists <local/vipw-vigr>

apparmor.d/profiles-s-z/who

@@ -19,6 +19,7 @@ profile who @{exec_path} {
   @{exec_path} mr,
 
   deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
+  deny owner @{user_share_dirs}/zed/**/data.mdb rw,
 
   include if exists <local/who>
 }