feat(profiles): general update.

apparmor.d/profiles-a-f/aa-notify

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}bin/aa-notify
 profile aa-notify @{exec_path} {
   include <abstractions/base>
+  include <abstractions/dbus-session-strict>
   include <abstractions/nameservice-strict>
   include <abstractions/python>
 

apparmor.d/profiles-a-f/appstreamcli

@@ -11,6 +11,7 @@ include <tunables/global>
 profile appstreamcli @{exec_path} flags=(complain) {
   include <abstractions/base>
   include <abstractions/consoles>
+  include <abstractions/nameservice-strict>
 
   capability dac_read_search,
 

apparmor.d/profiles-a-f/font-manager

@@ -10,12 +10,12 @@ include <tunables/global>
 profile font-manager @{exec_path} {
   include <abstractions/base>
   include <abstractions/dconf-write>
-  include <abstractions/gtk>
-  include <abstractions/fonts>
   include <abstractions/fontconfig-cache-write>
+  include <abstractions/fonts>
   include <abstractions/freedesktop.org>
-  include <abstractions/nameservice-strict>
   include <abstractions/gstreamer>
+  include <abstractions/gtk>
+  include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
 
   network inet dgram,
@@ -29,6 +29,8 @@ profile font-manager @{exec_path} {
   /{usr/,}lib/@{multiarch}/webkit*gtk-*/WebKitWebProcess     rix,
   /{usr/,}lib/@{multiarch}/webkit*gtk-*/WebKitNetworkProcess rix,
 
+  /usr/share/glib-2.0/schemas/gschemas.compiled r,
+
   owner @{user_cache_dirs}/ rw,
   owner @{user_cache_dirs}/font-manager/ rw,
   owner @{user_cache_dirs}/font-manager/* rwk,
@@ -47,18 +49,16 @@ profile font-manager @{exec_path} {
   owner @{user_share_dirs}/ r,
   owner @{user_share_dirs}/gvfs-metadata/{,*} r,
 
-  /usr/share/glib-2.0/schemas/gschemas.compiled r,
+  @{sys}/devices/virtual/dmi/id/chassis_type r,
+  @{sys}/firmware/acpi/pm_profile r,
+  @{sys}/fs/cgroup/{,**} r,
 
   owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/statm r,
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/smaps r,
-        @{PROC}zoneinfo r,
-
-  @{sys}/devices/virtual/dmi/id/chassis_type r,
-  @{sys}/firmware/acpi/pm_profile r,
-  @{sys}/fs/cgroup/{,**} r,
+        @{PROC}/zoneinfo r,
 
   # Silencer
        owner /var/cache/fontconfig/ w,

apparmor.d/profiles-a-f/fprintd

@@ -18,12 +18,7 @@ profile fprintd @{exec_path} flags=(attach_disconnected) {
   network netlink raw,
 
   dbus receive bus=system path=/net/reactivated/Fprint/Manager
-       interface=net.reactivated.Fprint.Manager
-       member={GetDefaultDevice,GetDevices},
-
-  dbus receive bus=system path=/net/reactivated/Fprint/Manager
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll,
+       interface={org.freedesktop.DBus.Properties,net.reactivated.Fprint.Manager},
 
   dbus send bus=system path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
@@ -33,7 +28,7 @@ profile fprintd @{exec_path} flags=(attach_disconnected) {
   dbus send bus=system path=/org/freedesktop/login[0-9]
        interface=org.freedesktop.login[0-9].Manager
        member=Inhibit
-        peer=(name=org.freedesktop.login[0-9]),
+       peer=(name=org.freedesktop.login[0-9]),
 
   dbus bind bus=system 
        name=net.reactivated.Fprint,

apparmor.d/profiles-a-f/frontend

@@ -23,13 +23,14 @@ profile frontend @{exec_path} flags=(complain) {
   /{usr/,}bin/locale     rix,
 
   # debconf apps
+  /{usr/,}{s,}bin/aspell-autobuildhash     rPx,
+  /{usr/,}{s,}bin/pam-auth-update          rPx,
   /{usr/,}bin/adequate                     rPx,
   /{usr/,}bin/debconf-apt-progress         rPx,
-  /{usr/,}lib/tasksel/tasksel-debconf      rPx -> tasksel,
   /{usr/,}bin/linux-check-removal          rPx,
   /{usr/,}bin/ucf                          rPx,
-  /{usr/,}sbin/pam-auth-update             rPx,
-  /{usr/,}sbin/aspell-autobuildhash        rPx,
+  /{usr/,}bin/whiptail                     rPx,
+  /{usr/,}lib/tasksel/tasksel-debconf      rPx -> tasksel,
   /usr/share/debian-security-support/check-support-status.hook rPx,
 
   # Run the package maintainer's scripts
@@ -55,13 +56,16 @@ profile frontend @{exec_path} flags=(complain) {
   /{usr/,}lib/dkms/dkms-*                 rPUx,
   /{usr/,}lib/dkms/dkms_*                 rPUx,
 
-  /etc/debconf.conf r,
   /usr/share/debconf/{,**} r,
+
+  /etc/debconf.conf r,
+  /etc/inputrc r,
+  /etc/shadow r,
+
+  owner /tmp/file* w,
   owner /var/cache/debconf/* rwk,
 
-  /etc/inputrc r,
-
-  /etc/shadow r,
+  @{run}/user/@{uid}/pk-debconf-socket rw,
 
   # The following is needed when debconf uses GUI frontends.
   include <abstractions/gtk>
@@ -74,11 +78,6 @@ profile frontend @{exec_path} flags=(complain) {
   owner @{PROC}/@{pid}/mounts r,
   @{HOME}/.Xauthority r,
 
-  # The following is needed when debconf uses dialog/whiptail frontend.
-  /{usr/,}bin/whiptail    rPx,
-  owner /tmp/file* w,
-
-
   profile scripts flags=(complain) {
     include <abstractions/base>
     include <abstractions/consoles>

apparmor.d/profiles-a-f/fwupd

@@ -86,11 +86,14 @@ profile fwupd @{exec_path} flags=(complain,attach_disconnected) {
   /dev/bus/usb/ r,
   /dev/bus/usb/[0-9]*/[0-9]* rw,
   /dev/drm_dp_aux[0-9]* rw,
+  /dev/gpiochip[0-9]* r,
   /dev/hidraw[0-9]* rw,
   /dev/mei[0-9]* rw,
   /dev/mem r,
+  /dev/mtd[0-9]* rw,
   /dev/sd[a-z]* r,
   /dev/tpm[0-9]* rw,
+  /dev/tpmrm[0-9]* rw,
   /dev/wmi/* r,
 
   profile gpg flags=(complain) {