feat(profile): update freedesktop profiles.

apparmor.d/groups/freedesktop/pulseaudio

@@ -21,9 +21,9 @@ profile pulseaudio @{exec_path} {
   include <abstractions/camera>
   include <abstractions/consoles>
   include <abstractions/dconf-write>
+  include <abstractions/desktop>
   include <abstractions/dri>
   include <abstractions/fontconfig-cache-write>
-  include <abstractions/desktop>
   include <abstractions/gstreamer>
   include <abstractions/hosts_access>
   include <abstractions/media-control>

apparmor.d/groups/freedesktop/wireplumber

@@ -27,6 +27,7 @@ profile wireplumber @{exec_path} {
   network netlink raw,
 
   #aa:dbus own bus=session name=org.freedesktop.ReserveDevice1.Audio@{int}
+  #aa:dbus own bus=session name=org.pipewire.Telephony
 
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
@@ -77,6 +78,7 @@ profile wireplumber @{exec_path} {
   @{sys}/devices/system/node/ r,
   @{sys}/devices/system/node/node@{int}/meminfo r,
   @{sys}/devices/virtual/dmi/id/bios_vendor r,
+  @{sys}/devices/virtual/dmi/id/board_vendor r,
   @{sys}/devices/virtual/dmi/id/product_name r,
   @{sys}/devices/virtual/dmi/id/sys_vendor r,
 

apparmor.d/groups/freedesktop/xdg-dbus-proxy

@@ -21,6 +21,9 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
 
   network unix stream,
 
+  #aa:dbus talk bus=session name=org.freedesktop.portal.Flatpak label=flatpak-portal
+  #aa:dbus talk bus=session name=org.freedesktop.portal.Request path=/org/freedesktop/portal/desktop label=xdg-desktop-portal
+
   dbus send bus=session path=/org/freedesktop/portal/desktop
        interface=org.freedesktop.portal.Realtime
        member=MakeThread*

apparmor.d/groups/freedesktop/xdg-desktop-portal

@@ -52,6 +52,7 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
 
   #aa:dbus own bus=session name=org.freedesktop.background.Monitor path=/org/freedesktop/background/monitor
 
+  #aa:dbus talk bus=session name=org.freedesktop.impl.portal.Inhibit label=xdg-desktop-portal-gtk
   #aa:dbus talk bus=session name=org.freedesktop.FileManager1 label=nautilus
   #aa:dbus talk bus=session name=org.freedesktop.impl.portal.FileChooser label=xdg-desktop-portal-gnome
   #aa:dbus talk bus=session name=org.freedesktop.portal.Documents path=/org/freedesktop/portal/documents label=xdg-document-portal
@@ -101,6 +102,7 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
   @{sys}/devices/virtual/dmi/id/sys_vendor r,
 
         @{PROC}/ r,
+        @{PROC}/@{pids}/status r,
         @{PROC}/*/ r,
         @{PROC}/1/cgroup r,
         @{PROC}/cmdline r,

apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome

@@ -16,6 +16,7 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus/org.freedesktop.Accounts>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
   include <abstractions/bus/org.gnome.Shell.Introspect>
+  include <abstractions/bus/org.gtk.vfs.Daemon>
   include <abstractions/bus/org.gtk.vfs.MountTracker>
   include <abstractions/consoles>
   include <abstractions/dconf-write>
@@ -24,6 +25,7 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) {
   include <abstractions/gnome-strict>
   include <abstractions/graphics>
   include <abstractions/nameservice-strict>
+  include <abstractions/notifications>
   include <abstractions/user-download-strict>
 
   network unix stream,
@@ -36,17 +38,13 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) {
   #aa:dbus talk bus=session name=org.gnome.Mutter label=gnome-shell
   #aa:dbus talk bus=session name=org.gnome.Settings.GlobalShortcutsProvider label=gnome-control-center-global-shortcuts-provider
   #aa:dbus talk bus=session name=org.gnome.Shell.Screenshot label=gnome-shell
+  #aa:dbus talk bus=session name=org.gtk.Private.RemoteVolumeMonitor label="gvfs-*-volume-monitor"
 
   dbus send bus=session path=/org/freedesktop/portal/desktop
        interface=org.freedesktop.impl.portal.Background
        member=RunningApplicationsChanged
        peer=(name=org.freedesktop.DBus, label=xdg-desktop-portal),
 
-  dbus send bus=session path=/org/gtk/Notifications
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll
-       peer=(name=:*, label=gnome-shell),
-
   dbus send bus=session path=/org/gnome/Shell
        interface=org.freedesktop.DBus.Properties
        member=GetAll
@@ -85,6 +83,8 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) {
   owner @{tmp}/gtkprint@{rand6} r,
   owner @{tmp}/xdg-desktop-portal-gnome@{rand6} rw,
 
+  owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw,
+
   @{run}/mount/utab r,
 
   owner @{PROC}/@{pid}/ r,

apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk

@@ -35,18 +35,12 @@ profile xdg-desktop-portal-gtk @{exec_path} flags=(attach_disconnected) {
 
   #aa:dbus own bus=session name=org.freedesktop.impl.portal.desktop.gtk
 
+  #aa:dbus talk bus=session name=org.gnome.ScreenSaver label=gjs
+  #aa:dbus talk bus=session name=org.freedesktop.impl.portal.Settings label=xdg-desktop-portal
+
   dbus receive bus=session path=/org/freedesktop/portal/desktop
        interface=org.freedesktop.impl.portal.Settings
        peer=(name=:*),
-  dbus send bus=session path=/org/freedesktop/portal/desktop
-       interface=org.freedesktop.impl.portal.Settings
-       member=SettingChanged
-       peer=(name=org.freedesktop.DBus, label=xdg-desktop-portal),
-
-  dbus send bus=session path=/org/gtk/Notifications
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll
-       peer=(name=:*, label=gnome-shell),
 
   @{exec_path} mr,
 

apparmor.d/groups/freedesktop/xdg-settings

@@ -15,7 +15,7 @@ profile xdg-settings @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} r,
 
-  @{sh_path}       r,
+  @{sh_path}        mr,
   @{bin}/{,e}grep  rix,
   @{bin}/basename  rix,
   @{bin}/cat        ix,

apparmor.d/groups/freedesktop/xorg

@@ -133,8 +133,9 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
   @{PROC}/ioports r,
   @{PROC}/mtrr rw,
 
+  /dev/ r,
   /dev/fb@{int} rw,
-  /dev/input/event@{int} rw,
+  @{att}/dev/input/event@{int} rw,
   /dev/input/mouse@{int} rw,
   /dev/shm/#@{int} rw,
   /dev/shm/shmfd-* rw,