feat(profile): general update.

apparmor.d/groups/gnome/gnome-music

@@ -48,6 +48,7 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) {
   @{run}/systemd/inhibit/[0-9]*.ref rw,
 
   owner @{tmp}/grilo-plugin-cache-[0-9A-Z]*/ rw,
+  owner /var/tmp/etilqs_@{hex15} rw,
   owner /var/tmp/etilqs_@{hex16} rw,
 
         @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,

apparmor.d/groups/gnome/gnome-session

@@ -17,8 +17,8 @@ profile gnome-session @{exec_path} {
 
   @{shells_path}               rix,
   @{bin}/cat                   rix,
-  @{bin}/gettext.sh              r,
   @{bin}/gettext               rix,
+  @{bin}/gettext.sh              r,
   @{bin}/grep                  rix,
   @{bin}/head                  rix,
   @{bin}/id                    rix,
@@ -28,6 +28,7 @@ profile gnome-session @{exec_path} {
   @{bin}/readlink              rix,
   @{bin}/realpath              rix,
   @{bin}/sed                   rix,
+  @{bin}/tput                  rix,
   @{bin}/tr                    rix,
   @{bin}/tty                   rix,
   @{bin}/uname                 rPx,

apparmor.d/groups/gnome/gnome-software

@@ -109,9 +109,12 @@ profile gnome-software @{exec_path} {
   owner /dev/shm/flatpak-com.*/.flatpak-tmpdir rw,
 
   @{run}/systemd/inhibit/*.ref rw,
+  @{run}/systemd/sessions/@{int} r,
+  @{run}/systemd/users/@{uid} r,
 
   @{sys}/module/nvidia/version r,
 
+        @{PROC}/@{pid}/cgroup r,
         @{PROC}/@{pids}/mounts r,
         @{PROC}/sys/fs/pipe-max-size r,
         @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,

apparmor.d/groups/gnome/org.gnome.NautilusPreviewer

@@ -39,9 +39,11 @@ profile org.gnome.NautilusPreviewer @{exec_path} {
 
   @{run}/udev/data/c@{dynamic}:@{int} r,  # For dynamic assignment range 234 to 254, 384 to 511
 
+  @{sys}/devices/system/node/node@{int}/cpumap r,
   @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*org.gnome.NautilusPreviewer.slice/*/memory.* r,
   @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/dbus.service/memory.* r,
 
+        @{PROC}/devices r,
         @{PROC}/@{pid}/cgroup r,
         @{PROC}/zoneinfo r,
   owner @{PROC}/@{pid}/cmdline r,
@@ -51,6 +53,7 @@ profile org.gnome.NautilusPreviewer @{exec_path} {
   owner @{PROC}/@{pid}/task/@{tid}/stat r,
 
   /dev/media@{int} r,
+  /dev/nvidia-uvm rw,
 
   include if exists <local/org.gnome.NautilusPreviewer>
 }

apparmor.d/groups/gnome/tracker-miner

@@ -87,8 +87,10 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
         @{PROC}/@{pid}/cmdline r,
         @{PROC}/sys/fs/fanotify/max_user_marks r,
         @{PROC}/sys/fs/inotify/max_user_watches r,
+        @{PROC}/sys/vm/mmap_min_addr r,
   owner @{PROC}/@{pid}/mountinfo r,
   owner @{PROC}/@{pid}/mounts r,
+  owner @{PROC}/@{pid}/task/@{tid}/comm rw,
 
         /dev/media@{int} rw,
         /dev/video@{int} rw,

apparmor.d/groups/kde/kreadconfig

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/kreadconfig5
 profile kreadconfig @{exec_path} {
   include <abstractions/base>
+  include <abstractions/kde-strict>
 
   capability dac_read_search,
 
@@ -16,14 +17,8 @@ profile kreadconfig @{exec_path} {
 
   @{exec_path} mr,
 
-  /usr/share/icu/@{int}.@{int}/*.dat r,
-
-  /etc/xdg/kdeglobals r,
   /etc/xdg/kioslaverc r,
 
-  owner @{user_config_dirs}/kdedefaults/kdeglobals r,
-  owner @{user_config_dirs}/kdeglobals r,
-
   include if exists <local/kreadconfig>
 }
 

apparmor.d/groups/virt/cockpit-bridge

@@ -35,9 +35,18 @@ profile cockpit-bridge @{exec_path} {
 
   @{exec_path} mr,
 
-  @{bin}/journalctl rPx,
-  @{lib}/cockpit/cockpit-pcp rPx,
-  @{lib}/cockpit/cockpit-ssh rPx,
+  @{bin}/cat                  ix,
+  @{bin}/date                 ix,
+  @{bin}/findmnt              Px,
+  @{bin}/journalctl           Px,
+  @{bin}/python3.@{int}       ix,
+  @{bin}/ssh-agent            Px,
+  @{bin}/sudo                 Px, # TODO: rCx -> privilieged ? or rix?
+  @{lib}/cockpit/cockpit-pcp  Px,
+  @{lib}/cockpit/cockpit-ssh  Px,
+
+  # The shell is not confined on purpose.
+  @{bin}/@{shells}            Ux,
 
   /usr/share/cockpit/{,**} r,
   /usr/{,local/}share/ r,
@@ -64,6 +73,7 @@ profile cockpit-bridge @{exec_path} {
   @{sys}/fs/cgroup/**/ r,
   @{sys}/fs/cgroup/**/cpu.{stat,weight} r,
   @{sys}/fs/cgroup/**/memory* r,
+  @{sys}/kernel/kexec_crash_size r,
 
         @{PROC}/ r,
         @{PROC}/@{pids}/cgroup r,