feat(profiles): improve kde integration.

apparmor.d/groups/kde/kactivitymanagerd

@@ -12,6 +12,7 @@ profile kactivitymanagerd @{exec_path} {
   include <abstractions/freedesktop.org>
   include <abstractions/nameservice-strict>
   include <abstractions/qt5>
+  include <abstractions/recent-documents-write>
   include <abstractions/X-strict>
 
   @{exec_path} mr,
@@ -38,8 +39,6 @@ profile kactivitymanagerd @{exec_path} {
 
   owner @{user_share_dirs}/kactivitymanagerd/{,**} rwlk,
   owner @{user_share_dirs}/kservices5/{,**} r,
-  owner @{user_share_dirs}/RecentDocuments/ r,
-  owner @{user_share_dirs}/RecentDocuments/*.desktop w,
 
   @{PROC}/sys/kernel/core_pattern r,
   @{PROC}/sys/kernel/random/boot_id r,

apparmor.d/groups/kde/kalendarac

@@ -26,8 +26,12 @@ profile kalendarac @{exec_path} {
   /usr/share/akonadi/plugins/serializer/{,*.desktop} r,
   /usr/share/hwdata/*.ids r,
   /usr/share/icu/@{int}.@{int}/*.dat r,
+  /usr/share/knotifications5/{,**} r,
+  /usr/share/sounds/{,**} r,
 
   /etc/machine-id r,
+  /etc/pulse/client.conf r,
+  /etc/pulse/client.conf.d/{,**} r,
   /etc/xdg/kdeglobals r,
 
   owner @{user_cache_dirs}/icon-cache.kcache rw,
@@ -43,8 +47,12 @@ profile kalendarac @{exec_path} {
   owner @{user_config_dirs}/kdedefaults/kdeglobals r,
   owner @{user_config_dirs}/kdeglobals r,
   owner @{user_config_dirs}/kmail2rc r,
+  owner @{user_config_dirs}/pulse/cookie rk,
 
-  @{run}/user/@{uid}/xauth_@{rand6} rl,
+  owner /tmp/xauth_@{rand6} r,
+
+  owner @{run}/user/@{uid}/pulse/ r,
+  owner @{run}/user/@{uid}/xauth_@{rand6} rl,
 
   @{PROC}/sys/kernel/core_pattern r,
 

apparmor.d/groups/kde/kcminit

@@ -42,8 +42,9 @@ profile kcminit @{exec_path} {
   owner @{user_config_dirs}/Trolltech.conf.lock rwk,
   owner @{user_config_dirs}/Trolltech.conf{,.@{rand6}} rwl,
 
-  owner /tmp/kcminit.@{rand6} rwl,
   owner /tmp/#@{int} rw,
+  owner /tmp/kcminit.@{rand6} rwl,
+  owner /tmp/xauth_@{rand6} r,
 
   owner /tmp/.touchpaddefaults wl,
   owner /tmp/.touchpaddefaults.lock rwk,

apparmor.d/groups/kde/kconf_update

@@ -16,6 +16,7 @@ profile kconf_update @{exec_path} {
   include <abstractions/mesa>
   include <abstractions/perl>
   include <abstractions/python>
+  include <abstractions/qt5>
 
   @{exec_path} mr,
 

apparmor.d/groups/kde/kde-powerdevil

@@ -18,10 +18,12 @@ profile kde-powerdevil @{exec_path} flags=(attach_disconnected mediate_deleted)
 
   @{exec_path} mrix,
 
+  @{bin}/kcminit rPx,
   @{lib}/drkonqi rPx,
 
   /usr/share/hwdata/*.ids r,
   /usr/share/icu/@{int}.@{int}/*.dat r,
+  /usr/share/knotifications5/*.notifyrc r,
 
   /etc/fstab r,
   /etc/xdg/kdeglobals r,

apparmor.d/groups/kde/kded5

@@ -68,8 +68,9 @@ profile kded5 @{exec_path} {
 
   owner @{HOME}/.gtkrc-2.0 rw,
 
+  owner @{user_cache_dirs}/#@{int} rw,
   owner @{user_cache_dirs}/icon-cache.kcache rw,
-  owner @{user_cache_dirs}/ksycoca5_* r,
+  owner @{user_cache_dirs}/ksycoca5_* rwlk -> @{user_cache_dirs}/#@{int},
 
   owner @{user_config_dirs}/#@{int} rw,
   owner @{user_config_dirs}/bluedevilglobalrc.lock rwk,
@@ -79,12 +80,14 @@ profile kded5 @{exec_path} {
   owner @{user_config_dirs}/kcminputrc r,
   owner @{user_config_dirs}/kconf_updaterc rw,
   owner @{user_config_dirs}/kconf_updaterc.lock rwk,
-  owner @{user_config_dirs}/kcookiejarrc r,
+  owner @{user_config_dirs}/kcookiejarrc.lock rwk,
+  owner @{user_config_dirs}/kcookiejarrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
   owner @{user_config_dirs}/kdebugrc r,
   owner @{user_config_dirs}/kded5rc.lock rwk,
   owner @{user_config_dirs}/kded5rc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
   owner @{user_config_dirs}/kdedefaults/{,**} r,
   owner @{user_config_dirs}/kdeglobals r,
+  owner @{user_config_dirs}/kwalletrc r,
   owner @{user_config_dirs}/khotkeysrc{,.@{rand6}} rw,
   owner @{user_config_dirs}/khotkeysrc.@{rand6} l -> @{user_config_dirs}/#@{int},
   owner @{user_config_dirs}/khotkeysrc.lock rwk,
@@ -95,8 +98,7 @@ profile kded5 @{exec_path} {
   owner @{user_config_dirs}/kxkbrc r,
   owner @{user_config_dirs}/libaccounts-glib/ rw,
   owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal,-journal} rwk,
-  owner @{user_config_dirs}/menus/ r,
-  owner @{user_config_dirs}/menus/applications-merged/ r,
+  owner @{user_config_dirs}/menus/{,**} r,
   owner @{user_config_dirs}/plasma-nm r,
   owner @{user_config_dirs}/touchpadrc r,
   owner @{user_config_dirs}/xsettingsd/{,**} rw,
@@ -104,7 +106,7 @@ profile kded5 @{exec_path} {
   owner @{user_share_dirs}/icc/{,edid-*} r,
   owner @{user_share_dirs}/kcookiejar/#@{int} rw,
   owner @{user_share_dirs}/kcookiejar/cookies.lock rwk,
-  owner @{user_share_dirs}/kcookiejar/cookies{,.@{rand6}} rwl -> @{user_share_dirs}/kcookiejar/#@{int},
+  owner @{user_share_dirs}/kcookiejar/cookies{,.@{rand6}} rwkl -> @{user_share_dirs}/kcookiejar/#@{int},
   owner @{user_share_dirs}/kded5/{,**} rw,
   owner @{user_share_dirs}/kscreen/{,**} rwl,
   owner @{user_share_dirs}/kservices5/{,**} r,
@@ -119,6 +121,9 @@ profile kded5 @{exec_path} {
 
   owner /tmp/plasma-csd-generator.@{rand6}/{,**} rw,
 
+  @{sys}/devices/system/node/ r,
+  @{sys}/devices/system/node/node@{int}/meminfo r,
+
         @{PROC}/@{pids}/cmdline/ r,
         @{PROC}/@{pids}/fd/ r,
         @{PROC}/@{pids}/fd/info/@{int} r,

apparmor.d/groups/kde/kio_http_cache_cleaner

@@ -15,7 +15,7 @@ profile kio_http_cache_cleaner @{exec_path} {
   /usr/share/icu/@{int}.@{int}/*.dat r,
   /usr/share/qt{5,}/translations/*.qm r,
 
-  owner @{user_cache_dirs}/kio_http/* rw,
+  owner @{user_cache_dirs}/kio_http/{,*} rw,
   owner @{user_config_dirs}/kio_httprc r,
 
   owner @{run}/user/@{uid}/kio_http_cache_cleaner rw,

apparmor.d/groups/kde/kioslave5

@@ -21,6 +21,7 @@ profile kioslave5 @{exec_path} {
   include <abstractions/ssl_certs>
   include <abstractions/trash>
   include <abstractions/vulkan>
+  include <abstractions/thumbnails-cache-read>
 
   network inet dgram,
   network inet6 dgram,
@@ -70,26 +71,36 @@ profile kioslave5 @{exec_path} {
   deny /tmp/.* rw,
   deny /tmp/.*/{,**} rw,
 
+  owner @{user_cache_dirs}/icon-cache.kcache rw,
+  owner @{user_cache_dirs}/kio_http/* rwl,
   owner @{user_cache_dirs}/ksycoca5_* r,
   owner @{user_cache_dirs}/thumbnails/*/ r,
-  owner @{user_cache_dirs}/kio_http/* rwl,
 
   owner @{user_config_dirs}/kdedefaults/kdeglobals r,
   owner @{user_config_dirs}/kdedefaults/kwinrc r,
   owner @{user_config_dirs}/kdeglobals r,
+  owner @{user_config_dirs}/kio_httprc r,
   owner @{user_config_dirs}/kwinrc r,
+  owner @{user_config_dirs}/menus/{,**} r,
 
   owner @{user_share_dirs}/baloo/index rw,
   owner @{user_share_dirs}/baloo/index-lock rwk,
   owner @{user_share_dirs}/kactivitymanagerd/resources/database rk,
   owner @{user_share_dirs}/kactivitymanagerd/resources/database-shm rwk,
   owner @{user_share_dirs}/kactivitymanagerd/resources/database-wal rw,
+  owner @{user_share_dirs}/kservices5/{,**} r,
+
+  owner /tmp/#@{int} rw,
+  owner /tmp/xauth_@{int} r,
 
         @{run}/mount/utab r,
   owner @{run}/user/@{uid}/#@{int} rw,
   owner @{run}/user/@{uid}/kio_desktop*kioworker.socket rwl,
   owner @{run}/user/@{uid}/xauth_@{rand6} rl,
 
+  @{sys}/devices/system/node/ r,
+  @{sys}/devices/system/node/node@{int}/meminfo r,
+
         @{PROC}/sys/kernel/core_pattern r,
   owner @{PROC}/@{pid}/mountinfo r,
   owner @{PROC}/@{pid}/mounts r,

apparmor.d/groups/kde/kreadconfig

@@ -10,6 +10,8 @@ include <tunables/global>
 profile kreadconfig @{exec_path} {
   include <abstractions/base>
 
+  capability dac_read_search,
+
   network netlink raw,
 
   @{exec_path} mr,

apparmor.d/groups/kde/kscreenlocker-greet

@@ -72,11 +72,6 @@ profile kscreenlocker-greet @{exec_path} {
   owner @{user_cache_dirs}/plasma-svgelements-default_v* r,
   owner @{user_cache_dirs}/plasma-svgelements.lock rwk,
   owner @{user_cache_dirs}/plasma-svgelements{,.@{rand6}} rwl,
-  owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/@{hex} rwl -> @{user_cache_dirs}/qtshadercache-*-little_endian-*/#@{int},
-  owner @{user_cache_dirs}/qtshadercache-*-little_endian-*/#@{int} rw,
-  owner @{user_cache_dirs}/qtshadercache/ rw,
-  owner @{user_cache_dirs}/qtshadercache/@{hex} rwl -> @{user_cache_dirs}/qtshadercache/#@{int},
-  owner @{user_cache_dirs}/qtshadercache/#@{int} rw,
 
   owner @{user_config_dirs}/kdedefaults/* r,
   owner @{user_config_dirs}/kdeglobals r,
@@ -89,6 +84,7 @@ profile kscreenlocker-greet @{exec_path} {
        owner @{HOME}/.glvnd* mrw,
 
   owner /tmp/*-cover-*.{jpg,png} r,
+  owner /tmp/xauth_@{rand6} r,
 
   @{run}/faillock/[a-zA-z0-9]* rwk,
 

apparmor.d/groups/kde/kwin_x11

@@ -16,6 +16,7 @@ profile kwin_x11 @{exec_path} {
   include <abstractions/freedesktop.org>
   include <abstractions/mesa>
   include <abstractions/nameservice-strict>
+  include <abstractions/qt5-shader-cache>
   include <abstractions/qt5>
   include <abstractions/vulkan>
 
@@ -54,7 +55,6 @@ profile kwin_x11 @{exec_path} {
   owner @{user_cache_dirs}/plasma_theme_*.kcache rw,
   owner @{user_cache_dirs}/plasma-svgelements.lock rwk,
   owner @{user_cache_dirs}/plasma-svgelements{,.@{rand6}} rwl,
-  owner @{user_cache_dirs}/qtshadercache-*/@{hex} r,
   owner @{user_cache_dirs}/session/#@{int} rw,
 
   owner @{user_config_dirs}/#@{int} rw,
@@ -70,6 +70,7 @@ profile kwin_x11 @{exec_path} {
 
   owner /tmp/#@{int} rw,
   owner /tmp/kwin.@{rand6} rwl,
+  owner /tmp/xauth_@{rand6} r,
 
   owner @{run}/user/@{uid}/kcrash_[0-9]* rw,
   owner @{run}/user/@{uid}/xauth_@{rand6} rl,

apparmor.d/groups/kde/plasmashell

@@ -36,8 +36,11 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
   network inet6 stream,
   network netlink raw,
 
-  ptrace (read) peer=pinentry-qt,
+  ptrace (read) peer=akonadi*,
+  ptrace (read) peer=kalendarac,
   ptrace (read) peer=kded5,
+  ptrace (read) peer=libreoffice*,
+  ptrace (read) peer=pinentry-qt,
 
   signal (send),
 
@@ -78,19 +81,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
   /etc/pipewire/client.conf.d/ r,
   /etc/pulse/client.conf r,
   /etc/pulse/client.conf.d/ r,
-  /etc/xdg/baloofilerc r,
-  /etc/xdg/dolphinrc r,
-  /etc/xdg/kdeglobals r,
-  /etc/xdg/kioslaverc r,
-  /etc/xdg/krunnerrc r,
-  /etc/xdg/kshorturifilterrc r,
-  /etc/xdg/kwinrc r,
-  /etc/xdg/menus/ r,
-  /etc/xdg/menus/applications-merged/ r,
-  /etc/xdg/menus/applications.menu r,
-  /etc/xdg/plasmanotifyrc r,
-  /etc/xdg/plasmarc r,
-  /etc/xdg/taskmanagerrulesrc r,
+  /etc/xdg/** r,
 
   owner @{HOME}/@{XDG_DESKTOP_DIR}/*.desktop r,
 
@@ -100,7 +91,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
   owner @{user_cache_dirs}/#@{int} rwk,
   owner @{user_cache_dirs}/event-sound-cache.tdb.@{md5}.x86_64-pc-linux-gnu rwk,
   owner @{user_cache_dirs}/icon-cache.kcache rw,
-  owner @{user_cache_dirs}/ksycoca5_* rl,
+  owner @{user_cache_dirs}/ksycoca5_* rwlk -> @{user_cache_dirs}/#@{int},
   owner @{user_cache_dirs}/org.kde.dirmodel-qml.kcache rw,
   owner @{user_cache_dirs}/plasma_theme_*.kcache rw,
   owner @{user_cache_dirs}/plasma-svgelements{,.@{rand6}} rwlk -> @{user_cache_dirs}/#@{int},
@@ -109,16 +100,16 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
   owner @{user_cache_dirs}/bookmarksrunner/ rw,
   owner @{user_cache_dirs}/bookmarksrunner/** rwkl -> @{user_cache_dirs}/bookmarksrunner/#@{int},
 
-  owner @{user_config_dirs}/#@{int} rwk,
+  owner @{user_config_dirs}/{KDE,kde.org}/ rw,
+  owner @{user_config_dirs}/{KDE,kde.org}/** rwkl -> @{user_config_dirs}/{KDE,kde.org}/#@{int},
   owner @{user_config_dirs}/*kde*.desktop* r,
-  owner @{user_config_dirs}/akonadi-firstrunrc r,
-  owner @{user_config_dirs}/akonadi/akonadiconnectionrc r,
+  owner @{user_config_dirs}/#@{int} rwk,
+  owner @{user_config_dirs}/akonadi* r,
+  owner @{user_config_dirs}/akonadi/akonadi*rc r,
   owner @{user_config_dirs}/baloofilerc r,
   owner @{user_config_dirs}/dolphinrc r,
   owner @{user_config_dirs}/eventviewsrc r,
   owner @{user_config_dirs}/kactivitymanagerd-statsrc r,
-  owner @{user_config_dirs}/{KDE,kde.org}/ rw,
-  owner @{user_config_dirs}/{KDE,kde.org}/** rwkl -> @{user_config_dirs}/{KDE,kde.org}/#@{int},
   owner @{user_config_dirs}/kdedefaults/* r,
   owner @{user_config_dirs}/kdeglobals r,
   owner @{user_config_dirs}/kioslaverc r,
@@ -127,6 +118,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
   owner @{user_config_dirs}/korganizerrc r,
   owner @{user_config_dirs}/krunnerrc r,
   owner @{user_config_dirs}/ksmserverrc r,
+  owner @{user_config_dirs}/kwalletrc r,
   owner @{user_config_dirs}/kwinrc r,
   owner @{user_config_dirs}/menus/{,**} r,
   owner @{user_config_dirs}/plasma* rwlk,
@@ -145,6 +137,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
   owner @{user_share_dirs}/krunnerstaterc rwl,
   owner @{user_share_dirs}/krunnerstaterc.@{rand6} rwl,
   owner @{user_share_dirs}/krunnerstaterc.lock rwk,
+  owner @{user_share_dirs}/kservices5/{,**} r,
   owner @{user_share_dirs}/ktp/cache.db rwk,
   owner @{user_share_dirs}/plasma_icons/*.desktop r,
   owner @{user_share_dirs}/plasma/plasmoids/{,**} r,
@@ -167,6 +160,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
   @{sys}/devices/system/node/node@{int}/meminfo r,
 
         @{PROC}/ r,
+        @{PROC}/cmdline r,
         @{PROC}/sys/kernel/core_pattern r,
         @{PROC}/sys/kernel/random/boot_id r,
   owner @{PROC}/@{pid}/{cgroup,cmdline,stat,statm} r,

apparmor.d/groups/kde/sddm-greeter

@@ -16,9 +16,9 @@ profile sddm-greeter @{exec_path} {
   include <abstractions/mesa>
   include <abstractions/nameservice-strict>
   include <abstractions/opencl>
+  include <abstractions/qt5-compose-cache-write>
   include <abstractions/qt5-shader-cache>
   include <abstractions/qt5>
-  include <abstractions/qt5-compose-cache-write>
 
   network netlink raw,
 
@@ -56,7 +56,6 @@ profile sddm-greeter @{exec_path} {
   owner @{user_cache_dirs}/icon-cache.kcache rw,
   owner @{user_cache_dirs}/plasma_theme_*.kcache rw,
   owner @{user_cache_dirs}/plasma-svgelements-* rw,
-  owner @{user_cache_dirs}/qtshadercache/{,**} rwl,
   owner @{user_cache_dirs}/sddm-greeter/{,**} rwl,
 
   owner @{user_config_dirs}/kdeglobals r,

apparmor.d/groups/kde/xdm-xsession

@@ -54,8 +54,9 @@ profile xdm-xsession @{exec_path} {
   @{HOME}/.xinitrc                                 rPix,
   @{lib}/xinit/xinitrc                          rix,
 
-  /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /usr/share/bash-completion/{,**} r,
+  /usr/share/glib-2.0/schemas/gschemas.compiled r,
+  /usr/share/mc/mc.sh r,
 
   @{etc_ro}/profile.d/{,*} r,
   @{etc_ro}/X11/xdm/scripts/{,*} r,