feat(profiles): general update.

apparmor.d/groups/bus/dbus-daemon

@@ -48,6 +48,7 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
   /{usr/,}lib/@{multiarch}/tumbler-1/tumblerd    rPUx,
 
   /usr/share/org.gnome.Characters/org.gnome.Characters.BackgroundService rPx,
+  /usr/share/org.gnome.Characters/org.gnome.Characters rPx,
   /usr/share/gnome-documents/org.gnome.Documents rPx,
 
   /etc/dbus-1/{,**} r,

apparmor.d/groups/gnome/gnome-control-center-print-renderer

@@ -31,6 +31,7 @@ profile gnome-control-center-print-renderer @{exec_path} {
   /usr/share/egl/{,**} r,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /usr/share/icons/{,**} r,
+  /usr/share/libdrm/*.ids r,
   /usr/share/mime/mime.cache r,
   /usr/share/pixmaps/{,**} r,
   /usr/share/X11/xkb/** r,

apparmor.d/groups/gnome/gsd-media-keys

@@ -167,17 +167,17 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
   /usr/share/sounds/freedesktop/stereo/*.oga r,
   /usr/share/X11/xkb/** r,
 
+  /var/lib/gdm{3,}/.config/dconf/user r,
+  /var/lib/gdm{3,}/greeter-dconf-defaults r,
+  /var/lib/gdm{3,}/.config/pulse/client.conf r,
+  /var/lib/gdm{3,}/.config/pulse/cookie rk,
+
   owner @{user_config_dirs}/pulse/ rw,
 
   owner @{user_share_dirs}/ r,
   owner @{user_share_dirs}/event-sound-cache.tdb.* rwk,
   owner @{user_share_dirs}/recently-used.xbel{,.*} rw,
 
-  /var/lib/gdm{3,}/.config/dconf/user r,
-  /var/lib/gdm{3,}/greeter-dconf-defaults r,
-  /var/lib/gdm{3,}/.config/pulse/client.conf r,
-  /var/lib/gdm{3,}/.config/pulse/cookie rk,
-
         @{run}/systemd/inhibit/[0-9]*.ref rw,
   owner @{run}/user/@{uid}/gdm/Xauthority r,
   owner @{run}/user/@{uid}/wayland-[0-9]* rw,
@@ -186,6 +186,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
   owner /dev/tty[0-9]* rw,
 
   @{run}/udev/data/c13:[0-9]* r,      # for /dev/input/*
+
   @{sys}/devices/platform/**/uevent r,
   @{sys}/devices/**/usb[0-9]/{,**} r,
 

apparmor.d/groups/gnome/gsd-xsettings

@@ -128,6 +128,7 @@ profile gsd-xsettings @{exec_path} {
   @{libexec}/ibus-x11        rPx,
 
   /usr/share/dconf/profile/gdm r,
+  /usr/share/gdm/greeter-dconf-defaults r,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /usr/share/libdrm/*.ids r,
 

apparmor.d/groups/gnome/nautilus

@@ -85,6 +85,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
   @{sys}/devices/**/hwmon/{,name,temp*,fan*} r,
   @{sys}/devices/**/hwmon/**/{,name,temp*,fan*} r,
   @{sys}/devices/pci[0-9]*/**/revision r,
+  @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_cur_freq r,
 
         @{PROC}/@{pids}/net/wireless r,
         @{PROC}/sys/dev/i915/perf_stream_paranoid r,

apparmor.d/groups/pacman/archlinux-keyring-wkd-sync

@@ -24,6 +24,7 @@ profile archlinux-keyring-wkd-sync @{exec_path} {
   /{usr/,}bin/bash         rix,
   /{usr/,}bin/dirmngr      rix,
   /{usr/,}bin/gpg          rix,
+  /{usr/,}bin/gpg-agent    rix,
   /{usr/,}bin/pacman-conf  rix,
 
   /etc/pacman.conf r,

apparmor.d/groups/ubuntu/check-new-release-gtk

@@ -55,9 +55,9 @@ profile check-new-release-gtk @{exec_path} {
 
   owner @{run}/user/@{uid}/wayland-[0-9] rw,
 
-  owner @{PROC}/@{pid}/fd/ r,
         @{PROC}/@{pids}/mountinfo r,
         @{PROC}/@{pids}/mounts r,
+  owner @{PROC}/@{pid}/fd/ r,
 
   include if exists <local/check-new-release-gtk>
 }

apparmor.d/groups/virt/docker-proxy

@@ -0,0 +1,22 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/docker-proxy
+profile docker-proxy @{exec_path} {
+  include <abstractions/base>
+
+  capability net_admin,
+
+  @{exec_path} mr,
+
+  @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
+  
+  @{PROC}/sys/net/core/somaxconn r,
+
+  include if exists <local/docker-proxy>
+}

apparmor.d/groups/virt/dockerd

@@ -57,6 +57,7 @@ profile dockerd @{exec_path} flags=(attach_disconnected) {
   /{usr/,}{s,}bin/xtables-nft-multi   rix,
   /{usr/,}bin/containerd              rPx,
   /{usr/,}bin/docker-init             rix,
+  /{usr/,}bin/docker-proxy            rPx,
   /{usr/,}bin/kmod                    rPx,
   /{usr/,}bin/ps                      rPx,
   /{usr/,}bin/unpigz                  rix,