diff --git a/apparmor.d/groups/akonadi/akonadi_mailfilter_agent b/apparmor.d/groups/akonadi/akonadi_mailfilter_agent index 96f662c8..6f353ab0 100644 --- a/apparmor.d/groups/akonadi/akonadi_mailfilter_agent +++ b/apparmor.d/groups/akonadi/akonadi_mailfilter_agent @@ -50,11 +50,16 @@ profile akonadi_mailfilter_agent @{exec_path} { owner @{user_config_dirs}/kdeglobals r, owner @{user_config_dirs}/kmail2rc r, owner @{user_config_dirs}/kwinrc r, + + owner /tmp/#[0-9]* rw, + owner /tmp/akonadi_mailfilter_agent.* rwl, owner @{user_config_dirs}/specialmailcollectionsrc r, owner @{user_share_dirs}/akonadi/file_db_data/{,**} rw, + @{system_share_dirs}/akonadi/plugins/serializer/{,akonadi_serializer_*.desktop} r, + @{PROC}/sys/kernel/core_pattern r, @{PROC}/sys/kernel/random/boot_id r, diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index 7ddb3289..1a8d9c84 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -89,7 +89,7 @@ profile plasmashell @{exec_path} { owner @{user_templates_dirs}/ r, owner @{user_cache_dirs}/ r, - owner @{user_cache_dirs}/#[0-9]* rw, + owner @{user_cache_dirs}/#[0-9]* rwk, owner @{user_cache_dirs}/event-sound-cache.tdb.*.x86_64-pc-linux-gnu rwk, owner @{user_cache_dirs}/icon-cache.kcache rw, owner @{user_cache_dirs}/ksycoca5_* r, @@ -101,7 +101,7 @@ profile plasmashell @{exec_path} { owner @{user_cache_dirs}/plasmashell/qmlcache/{,**} rwl, owner @{user_config_dirs}/*kde*.desktop* r, - owner @{user_config_dirs}/#[0-9]* rw, + owner @{user_config_dirs}/#[0-9]* rwk, owner @{user_config_dirs}/akonadi-firstrunrc r, owner @{user_config_dirs}/akonadi/akonadiconnectionrc r, owner @{user_config_dirs}/baloofilerc r, diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index e7d18064..7c10ad1f 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -172,6 +172,8 @@ profile pacman @{exec_path} { /etc/pacman.d/gnupg/** rwkl, @{HOME}/@{XDG_GPG_DIR}/*.conf r, + + /dev/tty[0-9]* rw, deny network inet stream, deny network inet6 stream,