Debian 12 Gnome DE

apparmor.d/groups/gnome/gdm-session-worker

@@ -19,6 +19,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
   capability dac_override,
   capability dac_read_search,
   capability fowner,
+  capability fsetid,
   capability kill,
   capability net_admin,
   capability setgid,
@@ -107,5 +108,10 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
   /dev/tty rw,
   /dev/tty@{int} rw,
 
+  # Add user; set password on first login
+  /etc/.pwd.lock wk,
+  /etc/nshadow rw,
+  /etc/shadow w,
+
   include if exists <local/gdm-session-worker>
 }