feat(profile): add signal from systemd-user.

apparmor.d/groups/freedesktop/at-spi-bus-launcher

@@ -22,6 +22,7 @@ profile at-spi-bus-launcher @{exec_path} flags=(attach_disconnected) {
   network inet6 dgram,
   network netlink raw,
 
+  signal (receive) set=(cont, term) peer=systemd-user,
   signal (receive) set=(term hup kill) peer=dbus-daemon,
   signal (receive) set=(term hup kill) peer=gdm*,
   signal (receive) set=(term hup kill) peer=gnome-session-binary,

apparmor.d/groups/freedesktop/pipewire

@@ -19,10 +19,12 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
 
   capability sys_ptrace,
 
-  ptrace (read),
-
   network netlink raw,
 
+  signal (receive) set=(cont, term) peer=systemd-user,
+
+  ptrace (read),
+
   # dbus: own bus=session name=org.pulseaudio.Server
 
   dbus send bus=session path=/org/freedesktop/DBus

apparmor.d/groups/freedesktop/xdg-desktop-portal

@@ -23,6 +23,8 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
 
   network netlink raw,
 
+  signal (receive) set=(cont, term) peer=systemd-user,
+
   ptrace (read),
 
   # dbus: own bus=session name=org.freedesktop.portal.Desktop path=/org/freedesktop/portal/desktop interface={org.freedesktop.DBus.Properties,org.freedesktop{,.impl}.portal.{Settings,Background}}

apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome

@@ -29,6 +29,7 @@ profile xdg-desktop-portal-gnome @{exec_path} {
 
   network unix stream,
 
+  signal (receive) set=(cont, term) peer=systemd-user,
   signal (receive) set=term peer=gdm,
 
   dbus bind bus=session name=org.freedesktop.impl.portal.desktop.gnome,

apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk

@@ -29,6 +29,8 @@ profile xdg-desktop-portal-gtk @{exec_path} {
   include <abstractions/user-download>
   include <abstractions/user-write>
 
+  signal (receive) set=(cont, term) peer=systemd-user,
+
   unix (send, receive, connect) type=stream peer=(addr="@/tmp/.X11-unix/*", label=gnome-shell),
 
   dbus bind bus=session name=org.freedesktop.impl.portal.desktop.gtk,

apparmor.d/groups/freedesktop/xdg-document-portal

@@ -18,10 +18,11 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
 
   mount fstype=fuse.portal -> @{run}/user/@{uid}/doc/,
 
-  ptrace (read) peer=xdg-desktop-portal,
-
+  signal (receive) set=(cont, term) peer=systemd-user,
   signal (receive) set=(term) peer=gdm,
 
+  ptrace (read) peer=xdg-desktop-portal,
+
   unix (send receive) type=stream peer=(label=xdg-document-portal//fusermount),
 
   # dbus: own bus=session name=org.freedesktop.portal.Documents path=/org/freedesktop/portal/documents
@@ -63,6 +64,8 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
 
     umount @{run}/user/@{uid}/doc/,
 
+    signal (receive) set=(cont, term) peer=systemd-user,
+
     unix (send receive) type=stream peer=(label=xdg-document-portal),
 
     @{bin}/fusermount{,3} mr,

apparmor.d/groups/freedesktop/xdg-permission-store

@@ -13,6 +13,7 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) {
 
   capability sys_nice,
 
+  signal (receive) set=(cont, term) peer=systemd-user,
   signal (receive) set=(term hup kill) peer=dbus-daemon,
   signal (receive) set=(term hup kill) peer=gdm*,
 

apparmor.d/groups/freedesktop/xwayland

@@ -13,6 +13,7 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
   include <abstractions/graphics>
   include <abstractions/X-strict>
 
+  signal (receive) set=(cont, term) peer=systemd-user,
   signal (receive) set=(term hup) peer=gdm*,
   signal (receive) set=(term hup) peer=gnome-shell,
   signal (receive) set=(term hup) peer=kwin_wayland,