update apparmor profiles

apparmor.d/groups/apps/calibre

@@ -32,6 +32,7 @@ profile calibre @{exec_path} {
   include <abstractions/mesa>
   include <abstractions/qt5-compose-cache-write>
   include <abstractions/qt5-settings-write>
+  include <abstractions/qt5-shader-cache>
   include <abstractions/thumbnails-cache-read>
   include <abstractions/user-download-strict>
   include <abstractions/nameservice-strict>

apparmor.d/groups/apps/dropbox

@@ -56,6 +56,7 @@ profile dropbox @{exec_path} {
   /{usr/,}bin/dirname    rix,
   /{usr/,}bin/uname      rix,
   /{usr/,}{s,}bin/ldconfig rix,
+  /{usr/,}lib/llvm-[0-9]*/bin/clang      rix,
   /{usr/,}bin/{,@{multiarch}-}gcc-[0-9]* rix,
   /{usr/,}bin/{,@{multiarch}-}objdump    rix,
 

apparmor.d/groups/apps/usr.lib.libreoffice.program.soffice.bin

@@ -73,32 +73,32 @@
 
 @{libo_user_dirs} = @{HOME} /mnt /media
 
-include <tunables/global>
+#include <tunables/global>
 
 profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(complain) {
-  include <abstractions/private-files>
+  #include <abstractions/private-files>
 
-  include <abstractions/audio>
-  include <abstractions/bash>
-  include <abstractions/cups-client>
-  include <abstractions/dbus>
-  include <abstractions/dbus-session>
-  include <abstractions/dbus-accessibility>
-  include <abstractions/dri-enumerate>
-  include <abstractions/mesa>
-  include <abstractions/ibus>
-  include <abstractions/nameservice>
-  include <abstractions/gnome>
+  #include <abstractions/audio>
+  #include <abstractions/bash>
+  #include <abstractions/cups-client>
+  #include <abstractions/dbus>
+  #include <abstractions/dbus-session>
+  #include <abstractions/dbus-accessibility>
+  #include <abstractions/dri-enumerate>
+  #include <abstractions/mesa>
+  #include <abstractions/ibus>
+  #include <abstractions/nameservice>
+  #include <abstractions/gnome>
 # GnuPG1 only...
-# include <abstractions/gnupg>
-  include <abstractions/python>
-  include <abstractions/p11-kit>
+# #include <abstractions/gnupg>
+  #include <abstractions/python>
+  #include <abstractions/p11-kit>
 
-  include <abstractions/user-tmp>
+  #include <abstractions/user-tmp>
 
-  include <abstractions/opencl-intel>
-  include <abstractions/opencl-mesa>
-  include <abstractions/opencl-nvidia>
+  #include <abstractions/opencl-intel>
+  #include <abstractions/opencl-mesa>
+  #include <abstractions/opencl-nvidia>
 
   #List directories for file browser
   /                                     r,
@@ -107,7 +107,7 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
   owner @{libo_user_dirs}/**/           rw,  #allow creating directories that we own
   owner @{libo_user_dirs}/**~lock.*     rw,  #lock file support
   owner @{libo_user_dirs}/**.@{libreoffice_ext} rwk,  #Open files rw with the right exts
-  owner @{libo_user_dirs}/{,**/}lu??????????{,?}.tmp rwk, #Temporary file used when saving
+  owner @{libo_user_dirs}/{,**/}lu???????????{,?}.tmp rwk, #Temporary file used when saving
   owner @{libo_user_dirs}/{,**/}.directory r, #Read directory settings on KDE
 
   # Settings
@@ -214,8 +214,8 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
   owner @{user_share_dirs}/user-places.xbel r,
 
   # there is abstractions/gnupg but that's just for gpg1...
-  profile gpg flags=(complain) {
-    include <abstractions/base>
+  profile gpg {
+    #include <abstractions/base>
 
    /usr/bin/gpgconf rm,
    /usr/bin/gpg rm,

apparmor.d/groups/apt/dpkg-architecture

@@ -12,16 +12,21 @@ profile dpkg-architecture @{exec_path} {
   include <abstractions/consoles>
   include <abstractions/perl>
 
+  capability dac_read_search,
+
   @{exec_path} r,
   /usr/bin/perl r,
 
   /{usr/,}bin/{,@{multiarch}-}gcc-[0-9]* rix,
+  /{usr/,}lib/llvm-[0-9]*/bin/clang      rix,
 
   /{usr/,}bin/ccache                     rCx -> ccache,
   /{usr/,}bin/dpkg                       rPx -> child-dpkg,
 
   /usr/share/dpkg/** r,
 
+  /etc/debian_version r,
+
   # file_inherit
   owner /tmp/* rw,
 
@@ -31,10 +36,14 @@ profile dpkg-architecture @{exec_path} {
 
     /{usr/,}bin/ccache mr,
 
+    /{usr/,}lib/llvm-[0-9]*/bin/clang      rix,
     /{usr/,}bin/{,@{multiarch}-}gcc-[0-9]* rix,
+    /{usr/,}bin/{,@{multiarch}-}g++-[0-9]* rix,
 
     /media/ccache/*/** rw,
 
+    /etc/debian_version r,
+
   }
 
   include if exists <local/dpkg-architecture>

apparmor.d/groups/browsers/firefox

@@ -1,5 +1,5 @@
 # apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2015-2020 Mikhail Morfikov
+# Copyright (C) 2015-2021 Mikhail Morfikov
 #               2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
@@ -100,6 +100,12 @@ profile firefox @{exec_path} {
   deny @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
   deny @{sys}/devices/system/cpu/cpu[0-9]/cache/index[0-9]/size r,
 
+  # For Cryptographic Attestation of Personhood
+  #@{sys}/bus/ r,
+  #@{sys}/class/ r,
+  #@{sys}/class/hidraw/ r,
+  #@{run}/udev/data/c241:[0-9]* r,  # dynamic
+
        owner @{PROC}/@{pid}/fd/ r,
        owner @{PROC}/@{pid}/cgroup r,
   deny owner @{PROC}/@{pid}/stat r,
@@ -126,6 +132,7 @@ profile firefox @{exec_path} {
 
   # Set default browser
   /{usr/,}bin/update-mime-database rPx,
+  owner @{user_config_dirs}/ r,
   owner @{user_config_dirs}/mimeapps.list{,.*} rw,
   owner @{user_share_dirs}/mime/packages/user-extension-{htm,html,xht,xhtml,shtml}.xml rw,
   owner @{user_share_dirs}/mime/packages/user-extension-{htm,html,xht,xhtml,shtml}.xml.* rw,

apparmor.d/groups/browsers/torbrowser.Tor.tor

@@ -1,10 +1,10 @@
-include <tunables/global>
-include <tunables/torbrowser>
+#include <tunables/global>
+#include <tunables/torbrowser>
 
 @{torbrowser_tor_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/TorBrowser/Tor/tor
 
 profile torbrowser_tor @{torbrowser_tor_executable} {
-  include <abstractions/base>
+  #include <abstractions/base>
 
   network netlink raw,
   network tcp,
@@ -24,7 +24,7 @@ profile torbrowser_tor @{torbrowser_tor_executable} {
   # Support some of the included pluggable transports
   owner @{torbrowser_home_dir}/TorBrowser/Tor/PluggableTransports/** rix,
   @{PROC}/sys/net/core/somaxconn r,
-  include <abstractions/ssl_certs>
+  #include <abstractions/ssl_certs>
 
   # Silence file_inherit logs
   deny @{torbrowser_home_dir}/{browser/,}omni.ja r,
@@ -38,6 +38,7 @@ profile torbrowser_tor @{torbrowser_tor_executable} {
 
   @{PROC}/sys/kernel/random/uuid r,
   /sys/devices/system/cpu/ r,
+  /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
 
   # OnionShare compatibility
   /tmp/onionshare/** rw,

apparmor.d/groups/bus/dbus-daemon

@@ -22,9 +22,6 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
 
   network netlink raw,
 
-  network bluetooth stream,
-  network bluetooth seqpacket,
-
   ptrace (read) peer=unconfined,
 
   @{exec_path} mr,

apparmor.d/groups/gpg/gpg-agent

@@ -36,6 +36,11 @@ profile gpg-agent @{exec_path} {
   owner /var/lib/*/gnupg/private-keys-v1.d/[0-9A-F]*.key rw,
   owner /var/lib/*/gnupg/S.gpg-agent{,.ssh,.browser,.extra} rw,
 
+  owner /tmp/tmp.*/gnupg/ rw,
+  owner /tmp/tmp.*/gnupg/private-keys-v1.d/ rw,
+  owner /tmp/tmp.*/gnupg/private-keys-v1.d/[0-9A-F]*.key rw,
+  owner /tmp/tmp.*/gnupg/S.gpg-agent rw,
+
   # For debuild
   owner /tmp/dpkg-import-key.*/private-keys-v1.d/ w,
   owner @{run}/user/@{uid}/gnupg/d.*/S.gpg-agent{,.extra,.browser,.ssh} w,

apparmor.d/groups/gpg/gpg-connect-agent

@@ -13,7 +13,18 @@ profile gpg-connect-agent @{exec_path} {
 
   @{exec_path} mr,
 
+  /{usr/,}bin/gpg-agent rPx,
+
   /etc/inputrc r,
 
+  owner @{PROC}/@{pid}/fd/ r,
+
+  owner @{run}/user/@{uid}/gnupg/d.*/ rw,
+
+  owner /tmp/tmp.*/.#lk0x[0-9a-f]*.*.@{pid} rw,
+  owner /tmp/tmp.*/.#lk0x[0-9a-f]*.*.@{pid}x rwl -> /tmp/*/.#lk0x[0-9a-f]*.*.@{pid},
+  owner /tmp/tmp.*/gnupg_spawn_agent_sentinel.lock rwl -> /tmp/*/.#lk0x[0-9a-f]*.*.@{pid},
+
   include if exists <local/gpg-connect-agent>
 }
+