feat(profiles): general update.

apparmor.d/profiles-a-f/blueman-mechanism

@@ -23,7 +23,6 @@ profile blueman-mechanism @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
-  /{usr/,}bin/python3.[0-9]* r,
   @{libexec}/ r,
 
   /var/lib/blueman/network.state rw,

apparmor.d/profiles-a-f/blueman-rfcomm-watcher

@@ -12,7 +12,6 @@ profile blueman-rfcomm-watcher @{exec_path} {
   include <abstractions/python>
 
   @{exec_path} r,
-  /{usr/,}bin/python3.[0-9]* r,
 
   @{libexec}/ r,
 

apparmor.d/profiles-a-f/boltd

@@ -32,6 +32,7 @@ profile boltd @{exec_path} {
   @{sys}/devices/pci[0-9]*/**/domain[0-9]*/**/ r,
   @{sys}/devices/pci[0-9]*/**/domain[0-9]*/**/{authorized,generation} r,
   @{sys}/devices/pci[0-9]*/**/domain[0-9]*/**/{uevent,unique_id} r,
+  @{sys}/devices/pci[0-9]*/**/domain[0-9]*/**/{vendor,device}_name r,
   @{sys}/devices/pci[0-9]*/**/domain[0-9]*/iommu_dma_protection r,
   @{sys}/devices/platform/**/uevent r,
   @{sys}/devices/virtual/dmi/id/product_name r,

apparmor.d/profiles-a-f/etckeeper

@@ -59,7 +59,9 @@ profile etckeeper @{exec_path} {
 
   @{run}/resolvconf/resolv.conf r,
 
-  /tmp/etckeeper-git* rw,
+  owner /tmp/etckeeper-git* rw,
+
+  owner @{PROC}/@{pid}/fd/ r,
 
   profile gpg {
     include <abstractions/base>

apparmor.d/profiles-a-f/evince

@@ -6,7 +6,7 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-@{exec_path} = /{usr/,}bin/evince /{usr/,}bin/evinced
+@{exec_path} = /{usr/,}bin/evince /{usr/,}lib/evinced
 profile evince @{exec_path} {
   include <abstractions/base>
   include <abstractions/dconf-write>
@@ -33,9 +33,9 @@ profile evince @{exec_path} {
   owner @{user_cache_dirs}/thumbnails/{,**} rw,
   owner @{user_config_dirs}/evince/{,*} rw,
 
+  owner /tmp/*.pdf r,
   owner /tmp/evince-*/{,**} rw,
-        /tmp/gtkprint* rw,
-        /tmp/*.pdf r,
+  owner /tmp/gtkprint* rw,
 
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mountinfo r,

apparmor.d/profiles-a-f/fprintd

@@ -11,6 +11,7 @@ profile fprintd @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/dbus-strict>
   include <abstractions/devices-usb>
+  include <abstractions/nameservice-strict>
 
   capability sys_nice,
 
@@ -41,8 +42,12 @@ profile fprintd @{exec_path} flags=(attach_disconnected) {
 
   /etc/fprintd.conf r,
 
+  /var/lib/fprint/{,**} rw,
+
   @{run}/systemd/journal/socket rw,
   @{run}/systemd/inhibit/*.ref w,
 
+  @{sys}/class/hidraw/ r,
+
   include if exists <local/fprintd>
 }

apparmor.d/profiles-a-f/freefall

@@ -10,18 +10,18 @@ include <tunables/global>
 profile freefall @{exec_path} {
   include <abstractions/base>
 
-  capability sys_nice,
   capability ipc_lock,
   capability mknod,
+  capability sys_nice,
 
   @{exec_path} mr,
 
+  @{sys}/devices/**/unload_heads r,
+  @{sys}/class/leds/**/brightness r,
+
   /dev/freefall rw,
   /dev/sd[a-z]* rk,
   /dev/sd[a-z]*[0-9]* rk,
 
-  @{sys}/devices/**/unload_heads r,
-  @{sys}/class/leds/**/brightness r,
-
   include if exists <local/freefall>
 }