feat(profile): improve xfce profiles stack.

apparmor.d/abstractions/desktop

@@ -47,6 +47,8 @@
 
   # else if @{DE} == xfce
 
+    /usr/share/xfce4/ r,
+
     owner @{user_config_dirs}/xfce4/help{,ers}.rc rw,
     owner @{user_config_dirs}/xfce4/help{,ers}.rc.@{int}.tmp rw,
 

apparmor.d/abstractions/xfce

@@ -8,6 +8,8 @@
   include <abstractions/wayland>
   include <abstractions/X-strict>
 
+  /usr/share/xfce4/ r,
+
   owner @{user_config_dirs}/xfce4/help{,ers}.rc rw,
   owner @{user_config_dirs}/xfce4/help{,ers}.rc.@{int}.tmp rw,
 

apparmor.d/groups/display-manager/lightdm

@@ -31,9 +31,10 @@ profile lightdm @{exec_path} flags=(attach_disconnected) {
 
   network netlink raw,
 
-  signal (send) set=(term) peer=lightdm-*-greeter,
-  signal (send) set=(term) peer=xorg,
   signal (receive) set=(usr1) peer=xorg,
+  signal (send) set=(term) peer=lightdm-*-greeter,
+  signal (send) set=(term) peer=xfce-session,
+  signal (send) set=(term) peer=xorg,
 
   @{exec_path} mrix,
 

apparmor.d/groups/xfce/ristretto

@@ -10,6 +10,7 @@ include <tunables/global>
 profile ristretto @{exec_path} {
   include <abstractions/base>
   include <abstractions/thumbnails-cache-read>
+  include <abstractions/trash-strict>
   include <abstractions/user-read-strict>
   include <abstractions/user-write-strict>
   include <abstractions/xfce>
@@ -20,7 +21,13 @@ profile ristretto @{exec_path} {
 
   /usr/share/file/{,**} r,
 
+  /etc/magic r,
+  /etc/timezone r,
+
   owner @{user_config_dirs}/ristretto/{,**} rw,
+  owner @{user_share_dirs}/ristretto/{,**} rw,
+
+  deny @{user_share_dirs}/gvfs-metadata/* r,
 
   include if exists <local/ristretto>
 }

apparmor.d/groups/xfce/thunar

@@ -23,6 +23,7 @@ profile thunar @{exec_path} {
   @{open_path} rPx -> child-open,
 
   /usr/share/ r,
+  /usr/share/anon-apps-config/share/{,**} r, #aa:only whonix
   /usr/share/Thunar/{,**} r,
 
   /etc/fstab r,

apparmor.d/groups/xfce/xfce-session

@@ -14,6 +14,8 @@ profile xfce-session @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/xfce>
 
+  signal (receive) set=(term) peer=lightdm,
+
   @{exec_path} mr,
 
   @{sh_path} rix,

apparmor.d/groups/xfce/xfwm

@@ -21,5 +21,7 @@ profile xfwm @{exec_path} {
 
   /etc/machine-id r,
 
+  owner @{user_cache_dirs}/sessions/xfwm4-*.state rw,
+
   include if exists <local/xfwm>
 }