Update profiles.

apparmor.d/groups/gnome/nautilus

@@ -18,8 +18,9 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
   /{usr/,}bin/{,ba,da}sh rix,
 
   /usr/share/nautilus/{,**} r,
-  /usr/share/tracker3/{,**} r,
+  /usr/share/poppler/{,**} r,
   /usr/share/sounds/freedesktop/stereo/*.oga r,
+  /usr/share/tracker3/{,**} r,
 
   owner @{user_share_dirs}/nautilus/{,**} rwk,
 

apparmor.d/groups/gnome/tracker-extract

@@ -44,10 +44,12 @@ profile tracker-extract @{exec_path} {
 
   @{run}/udev/data/c235:* r,
   @{run}/udev/data/c236:* r,
-  @{run}/udev/data/c51[0-9]:* r,
+  @{run}/udev/data/c50[0-9]:[0-9]* r,
+  @{run}/udev/data/c51[0-9]:[0-9]* r,
 
-  /dev/video[0-9]* rw,
   /dev/dri/renderD128 rw,
+  /dev/media[0-9]* r,
+  /dev/video[0-9]* rw,
 
   include if exists <local/tracker-extract>
 }

apparmor.d/groups/pacman/pacman

@@ -74,7 +74,6 @@ profile pacman @{exec_path} {
   /{usr/,}bin/update-ca-trust             rPx,
   /{usr/,}bin/update-desktop-database     rPx,
   /{usr/,}bin/update-mime-database        rPx,
-  /{usr/,}lib/dkms/alpm-hook              rPx,
   /{usr/,}lib/systemd/systemd-*           rPx,
   /{usr/,}lib/vlc/vlc-cache-gen           rPx,
   /usr/share/libalpm/scripts/*            rPx,

apparmor.d/groups/pacman/pacman-hook-dkms

@@ -6,7 +6,7 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-@{exec_path} = /{usr/,}lib/dkms/alpm-hook
+@{exec_path} = /usr/share/libalpm/scripts/dkms
 profile pacman-hook-dkms @{exec_path} {
   include <abstractions/base>
 

apparmor.d/groups/pacman/pacman-key

@@ -26,6 +26,7 @@ profile pacman-key @{exec_path} {
   /{usr/,}bin/wc           rix,
 
   /usr/share/makepkg/{,**} r,
+  /usr/share/pacman/keyrings/* r,
   /usr/share/terminfo/x/xterm-256color r,
 
   /dev/tty rw,
@@ -41,7 +42,7 @@ profile pacman-key @{exec_path} {
     capability mknod,
 
     /{usr/,}bin/gpg        mr,
-    /{usr/,}bin/gpg-agent  mr,
+    /{usr/,}bin/gpg-agent  rix,
 
     /usr/share/pacman/keyrings/* r,
 

apparmor.d/groups/systemd/systemd-logind

@@ -43,6 +43,8 @@ profile systemd-logind @{exec_path} flags=(complain) {
   @{run}/udev/data/c116:[0-9]* r, # for ALSA
   @{run}/udev/data/c226:[0-9]* r, # for /dev/dri/card*
   @{run}/udev/data/c23[0-9]:[0-9]* r,
+  @{run}/udev/data/c50[0-9]:[0-9]* r,
+  @{run}/udev/data/c51[0-9]:[0-9]* r,
 
   @{run}/udev/data/+input* r,          # for mouse, keyboard, touchpad
   @{run}/udev/data/+drm:card[0-9]-* r, # for screen outputs