Profiles update and general fixes.

apparmor.d/abstractions/mesa.d/complete

@@ -0,0 +1,11 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+  # Extra Mesa rules for GDM
+  /var/lib/gdm/.cache/ w,
+  /var/lib/gdm/.cache/mesa_shader_cache/ rw,
+  /var/lib/gdm/.cache/mesa_shader_cache/index rw,
+  /var/lib/gdm/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/ rw,
+  /var/lib/gdm/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/[0-9a-f]* rw,
+  /var/lib/gdm/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/[0-9a-f]*.tmp rwk,

apparmor.d/groups/browsers/chrome-gnome-shell

@@ -9,11 +9,10 @@ include <tunables/global>
 @{exec_path} = /{usr/,}bin/chrome-gnome-shell
 profile chrome-gnome-shell @{exec_path} {
   include <abstractions/base>
-  include <abstractions/python>
   include <abstractions/nameservice-strict>
-  include <abstractions/dconf>
-  include <abstractions/ssl_certs>
   include <abstractions/openssl>
+  include <abstractions/python>
+  include <abstractions/ssl_certs>
 
   network inet dgram,
   network inet6 dgram,
@@ -25,6 +24,10 @@ profile chrome-gnome-shell @{exec_path} {
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
+  include <abstractions/dconf>
+  owner @{run}/user/[0-9]*/dconf/ rw,
+  owner @{run}/user/[0-9]*/dconf/user rw,
+
   owner @{PROC}/@{pid}/mounts r,
 
   include if exists <local/chrome-gnome-shell>

apparmor.d/groups/desktop/blueman

@@ -34,6 +34,7 @@ profile blueman @{exec_path} {
   /{usr/,}bin/xdg-open rCx -> open,
 
   /usr/share/blueman/{,**} r,
+  /usr/share/X11/xkb/{,**} r,
 
   owner @{user_cache_dirs}/blueman-tray-[0-9]* rw,
   owner @{user_cache_dirs}/blueman-services-[0-9]* rw,

apparmor.d/groups/desktop/colord

@@ -45,5 +45,7 @@ profile colord @{exec_path} flags=(attach_disconnected) {
 
   @{user_share_dirs}/icc/edid-*.icc r,
 
+  @{run}/systemd/sessions/[0-9] r,
+
   include if exists <local/colord>
 }

apparmor.d/groups/desktop/dbus-daemon

@@ -37,6 +37,7 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
   /usr/share/defaults/**.conf r,
 
   owner @{user_share_dirs}/dbus-1/{,**} r,
+  owner @{user_share_dirs}/icc/{,edid-*.icc} r,
 
   owner @{PROC}/@{pid}/mounts r,
   owner @{PROC}/@{pid}/oom_score_adj rw,

apparmor.d/groups/desktop/xwayland

@@ -31,13 +31,6 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
   /dev/tty[0-9]* rw,
   /dev/tty rw,
 
-  # Extra Mesa rules for GDM
-  owner /var/lib/gdm/.cache/ w,
-  owner /var/lib/gdm/.cache/mesa_shader_cache/ r,
-  owner /var/lib/gdm/.cache/mesa_shader_cache/index rw,
-  owner /var/lib/gdm/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/ r,
-  owner /var/lib/gdm/.cache/mesa_shader_cache/[a-f0-9][a-f0-9]/[0-9a-f]* r,
-
   # Needed for Mutter
   owner @{run}/user/@{pid}/.mutter-Xwaylandauth.[a-zA-z0-9]* rw,
 

apparmor.d/groups/gnome/evolution-source-registry

@@ -22,7 +22,7 @@ profile evolution-source-registry @{exec_path} {
   @{exec_path} mr,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
-  owner @{user_config_dirs}/evolution/sources/{,*} r,
+  owner @{user_config_dirs}/evolution/sources/{,*} rw,
   owner @{user_share_dirs}/evolution/{,**} r,
   owner @{user_share_dirs}/gvfs-metadata/{,*} r,
   owner @{user_cache_dirs}/evolution/{,**} rwk,

apparmor.d/groups/gnome/gjs-console

@@ -9,9 +9,12 @@ include <tunables/global>
 @{exec_path}  = /{usr/,}bin/gjs-console
 profile gjs-console @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/dri-common>
+  include <abstractions/dri-enumerate>
   include <abstractions/fonts>
   include <abstractions/freedesktop.org>
   include <abstractions/gtk>
+  include <abstractions/mesa>
   include <abstractions/openssl>
 
   network netlink raw,
@@ -24,6 +27,7 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
   /usr/share/dconf/profile/gdm r,
   /usr/share/gdm/greeter-dconf-defaults r,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
+  /usr/share/glvnd/egl_vendor.d/{,*.json} r,
   /usr/share/gnome-shell/{,**} r,
   /usr/share/themes/*/gtk-3.0/{,**} r,
   /usr/share/X11/xkb/** r,
@@ -49,12 +53,8 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
   @{run}/user/[0-9]*/gdm/Xauthority r,
 
   /dev/ r,
-  /dev/dri/ r,
   /dev/tty rw,
   /dev/tty[0-9]* rw,
 
-  @{sys}/bus/ r,
-  @{sys}/class/ r,
-
   include if exists <local/gjs-console>
 }

apparmor.d/groups/gnome/gnome-contacts

@@ -22,6 +22,9 @@ profile gnome-contacts @{exec_path} {
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
+  owner @{user_cache_dirs}/evolution/addressbook/{,**} r,
+  owner @{user_cache_dirs}/gstreamer*/{,**} r,
+  owner @{user_config_dirs}/gnome-contacts/{,**} rw,
   owner @{user_share_dirs}/folks/relationships.ini r,
 
   include <abstractions/dconf>

apparmor.d/groups/gnome/gnome-shell

@@ -36,8 +36,12 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   /{usr/,}{lib,libexec}/polkit-1/polkit* rPx,
   /{usr/,}{lib,libexec}/*                rPUx,
 
+  /usr/share/backgrounds/{,**} r,
   /usr/share/desktop-directories/{,*.directory} r,
+  /usr/share/gdm/greeter-dconf-defaults r,
+  /usr/share/gdm/greeter/applications/{,**} r,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
+  /usr/share/glvnd/egl_vendor.d/{,*.json} r,
   /usr/share/gnome-shell/{,**} r,
   /usr/share/libgweather/Locations.xml r,
   /usr/share/libinput/ r,
@@ -47,9 +51,13 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   /usr/share/xml/iso-codes/iso_[0-9]*-[0-9]*.xml r,
   /usr/share/xsessions/{,*.desktop} r,
 
+  /etc/fstab r,
   /etc/machine-id r,
   /var/lib/dbus/machine-id r,
 
+  /var/lib/gdm/.config/pulse/client.conf r,
+  /var/lib/gdm/.local/share/applications/{,**} r,
+
   owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
   owner @{HOME}/.mozilla/firefox/firefox-mpris/{,*} r,
 
@@ -64,11 +72,14 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   include <abstractions/dconf>
   owner @{run}/user/[0-9]*/dconf/ rw,
   owner @{run}/user/[0-9]*/dconf/user rw,
+  /usr/share/dconf/profile/gdm r,
+  /var/lib/gdm/.config/dconf/user r,
 
   owner @{run}/user/[0-9]*/gnome-shell/{,**} rw,
   owner @{run}/user/[0-9]*/gnome-shell-disable-extensions rw,
   owner @{run}/user/[0-9]*/wayland-[0-9].lock rwk,
   owner @{run}/user/[0-9]*/gdm/Xauthority r,
+  owner @{run}/user/[0-9]*/.mutter-Xwaylandauth.[0-9A-Z]* rw,
 
   @{run}/systemd/users/[0-9]* r,
   @{run}/systemd/sessions/[0-9] r,
@@ -111,6 +122,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   owner @{PROC}/[0-9]*/fd/ r,
   owner @{PROC}/[0-9]*/cgroup r,
   owner @{PROC}/[0-9]*/mounts r,
+  owner @{PROC}/[0-9]*/mountinfo r,
   owner @{PROC}/[0-9]*/attr/current r,
         @{PROC}/[0-9]*/stat r,
         @{PROC}/[0-9]*/task/[0-9]*/stat r,

apparmor.d/profiles-a-l/aa-notify

@@ -23,8 +23,8 @@ profile aa-notify @{exec_path} flags=(complain) {
   /usr/share/terminfo/d/dumb r,
   /var/log/audit/audit.log r,
 
-  owner /tmp/[a-z0-9]* r,
-  owner /tmp/apparmor-bugreport-[a-z0-9]*.txt rw,
+  owner /tmp/[a-z0-9]* rw,
+  owner /tmp/apparmor-bugreport-*.txt rw,
 
   @{PROC}/ r,
   @{PROC}/@{pid}/stat r,