feat(profile): general update.

apparmor.d/abstractions/video.d/complete

@@ -0,0 +1,5 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+  @{sys}/devices/@{pci}/video4linux/video@{int}/uevent r,

apparmor.d/groups/browsers/firefox

@@ -59,42 +59,28 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
        dbus bind bus=session name=org.mozilla.firefox_beta.*,
   deny dbus send bus=system path=/org/freedesktop/hostname1,
 
-  dbus send bus=session path=/ScreenSaver
+  dbus bind bus=session name=org.mozilla.firefox.*,
-       interface=org.freedesktop.ScreenSaver
+  dbus receive bus=session path=/org/mozilla/firefox/*
-       peer=(name=org.freedesktop.ScreenSaver),
+       interface=org.mozilla.firefox
-
+       peer=(name=:*, label=@{profile_name}),
-  dbus send bus=system path=/org/freedesktop/UPower
+  dbus send bus=session path=/org/mozilla/firefox/*
-       interface=org.freedesktop.UPower
+       interface=org.mozilla.firefox
-       member=EnumerateDevices
+       peer=(name=org.mozilla.firefox.*, label=@{profile_name}),
-       peer=(name=org.freedesktop.UPower),
-
-  dbus send bus=session path=/org/freedesktop/PowerManagement/Inhibit
-       interface=org.freedesktop.PowerManagement.Inhibit
-       member=Inhibit
-       peer=(name=org.freedesktop.PowerManagement),
 
+  dbus bind bus=session name=org.mpris.MediaPlayer2.firefox.*,
   dbus (send, receive) bus=session path=/org/mpris/MediaPlayer2
        interface=org.freedesktop.DBus.Properties
        member={GetAll,PropertiesChanged}
        peer=(name="{org.freedesktop.DBus,:*}"),
-
   dbus receive bus=session path=/org/mpris/MediaPlayer2
        interface=org.mpris.MediaPlayer2.Playlists
        member=GetPlaylists
        peer=(name=:*),
 
-  dbus send bus=session path=/org/gtk/vfs/metadata
+  dbus send bus=session path=/org/freedesktop/PowerManagement/Inhibit
-       interface=org.gtk.vfs.Metadata
+       interface=org.freedesktop.PowerManagement.Inhibit
-       member=GetTreeFromDevice
+       member=Inhibit
-       peer=(name=:*, label=gvfsd-metadata),
+       peer=(name=org.freedesktop.PowerManagement),
-
-  dbus send bus=session path=/org/mozilla/firefox/Remote
-       interface=org.mozilla.firefox
-       peer=(name=org.mozilla.firefox.*, label=@{profile_name}),
-
-  dbus receive bus=session path=/org/mozilla/firefox/Remote
-       interface=org.mozilla.firefox
-       peer=(name=:*, label=@{profile_name}),
 
   @{exec_path} mrix,
 
@@ -110,7 +96,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
   @{lib_dirs}/pingsender        rPx,
   @{lib_dirs}/plugin-container  rPx,
   @{lib_dirs}/vaapitest         rPx,
-  @{lib}/mozilla/kmozillahelper        rPUx,
+  @{lib}/mozilla/kmozillahelper rPUx,
 
   @{lib}/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemX11Plugin.so mr,
   @{lib}/mozilla/plugins/ r,
@@ -192,8 +178,8 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
         /var/tmp/ r,
   owner /tmp/user/@{uid}/ rw,
   owner /tmp/user/@{uid}/* rwk,
-  owner /tmp/user/@{uid}/Temp-*/ rw,
+  owner /tmp/user/@{uid}/Temp-@{uuid}/ rw,
-  owner /tmp/user/@{uid}/Temp-*/* rwk,
+  owner /tmp/user/@{uid}/Temp-@{uuid}/* rwk,
   owner /tmp/user/@{uid}/@{name}/ rw,
   owner /tmp/user/@{uid}/@{name}/* rwk,
   owner /tmp/@{name}/ rw,
@@ -206,7 +192,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
   owner /tmp/MozillaBackgroundTask-*-removeDirectory/ rw,
   owner /tmp/MozillaBackgroundTask-*-removeDirectory/** rwk,
   owner /tmp/Mozillato-be-removed-cachePurge-* k,
-  owner /tmp/Temp-*/ rw,
+  owner /tmp/Temp-@{uuid}/ rw,
 
   @{run}/mount/utab r,
 

apparmor.d/groups/browsers/firefox-glxtest

@@ -25,7 +25,7 @@ profile firefox-glxtest @{exec_path} {
 
   owner @{config_dirs}/firefox/*/.parentlock rw,
 
-  owner /tmp/firefox/.parentlock rw,
+  owner /tmp/@{name}/.parentlock rw,
 
   @{sys}/bus/pci/devices/ r,
   @{sys}/devices/@{pci}/class r,

apparmor.d/groups/browsers/firefox-vaapitest

@@ -25,7 +25,7 @@ profile firefox-vaapitest @{exec_path} {
   /etc/igfx_user_feature{,_next}.txt w,
   /etc/libva.conf r,
 
-  owner /tmp/firefox/.parentlock rw,
+  owner /tmp/@{name}/.parentlock rw,
 
   @{sys}/devices/@{pci}/{irq,revision,resource} r,
   @{sys}/devices/@{pci}/config r,

apparmor.d/groups/gnome/gnome-shell-calendar-server

@@ -17,6 +17,12 @@ profile gnome-shell-calendar-server @{exec_path} {
   dbus receive bus=session path=/org/gnome/Shell/CalendarServer
        interface=org.gnome.Shell.CalendarServer
        peer=(name=:*, label=gnome-shell),
+  dbus (send receive) bus=session path=/org/gnome/Shell/CalendarServer
+       interface=org.freedesktop.DBus.Properties
+       peer=(name=:*),
+  dbus send bus=session path=/org/gnome/Shell/CalendarServer
+       interface=org.freedesktop.DBus.Properties
+       peer=(name=org.freedesktop.DBus),
 
   dbus (send receive) bus=session path=/org/gnome/evolution/dataserver/{,**}
        interface=org.freedesktop.DBus.Properties

apparmor.d/groups/gnome/goa-daemon

@@ -13,8 +13,8 @@ profile goa-daemon @{exec_path} {
   include <abstractions/bus-system>
   include <abstractions/bus/org.freedesktop.NetworkManager>
   include <abstractions/dconf-write>
+  include <abstractions/gnome-strict>
   include <abstractions/nameservice-strict>
-  include <abstractions/opencl>
   include <abstractions/openssl>
   include <abstractions/p11-kit>
   include <abstractions/ssl_certs>
@@ -39,15 +39,8 @@ profile goa-daemon @{exec_path} {
        member=GetAll
        peer=(name=:*, label=goa-identity-service),
 
-  dbus receive bus=session
-       interface=org.freedesktop.DBus.Introspectable
-       member=Introspect
-       peer=(name=:*, label=gnome-shell),
-
   @{exec_path} mr,
 
-  /usr/share/glib-2.0/schemas/gschemas.compiled r,
-
   /var/lib/gdm{3,}/.config/dconf/user r,
 
   owner @{user_config_dirs}/goa-1.0/ rw,

apparmor.d/groups/gnome/gsd-keyboard

@@ -18,27 +18,17 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus/org.gtk.vfs.MountTracker>
   include <abstractions/dconf-write>
   include <abstractions/fontconfig-cache-read>
-  include <abstractions/fonts>
+  include <abstractions/gnome-strict>
-  include <abstractions/gtk>
   include <abstractions/nameservice-strict>
-  include <abstractions/wayland>
 
   signal (receive) set=(term, hup) peer=gdm*,
 
   dbus bind bus=session name=org.gnome.SettingsDaemon.Keyboard,
 
-  dbus receive bus=session
-       interface=org.freedesktop.DBus.Introspectable
-       member=Introspect
-       peer=(name=:*, label=gnome-shell),
-
   @{exec_path} mr,
 
   /usr/share/dconf/profile/gdm r,
   /usr/share/gdm/greeter-dconf-defaults r,
-  /usr/share/glib-2.0/schemas/gschemas.compiled r,
-  /usr/share/icons/{,**} r,
-  /usr/share/X11/xkb/** r,
 
   /var/lib/gdm{3,}/.config/dconf/user r,
   /var/lib/gdm{3,}/greeter-dconf-defaults r,
@@ -47,8 +37,6 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
   owner @{user_config_dirs}/.gsd-keyboard.settings-ported* rw,
   owner @{user_share_dirs}/gnome-settings-daemon/{,input-sources*} rw,
 
-  owner @{run}/user/@{uid}/gdm/Xauthority r,
-
   owner /dev/tty@{int} rw,
 
   include if exists <local/gsd-keyboard>

apparmor.d/profiles-g-l/hw-probe

@@ -231,18 +231,8 @@ profile hw-probe @{exec_path} {
     owner @{PROC}/@{pid}/net/if_inet6 r,
     owner @{PROC}/@{pid}/net/dev r,
 
+    include if exists <local/hw-probe_netconfig>
   }
 
-  profile curl {
-    include <abstractions/base>
-    include <abstractions/nameservice-strict>
-    include <abstractions/openssl>
-    include <abstractions/ssl_certs>
-
-    @{bin}/curl mr,
-
-  }
-
-
   include if exists <local/hw-probe>
 }

apparmor.d/profiles-m-r/mate-notification-daemon

@@ -11,6 +11,7 @@ profile mate-notification-daemon @{exec_path} {
   include <abstractions/base>
   include <abstractions/fonts>
   include <abstractions/dconf-write>
+  include <abstractions/freedesktop.org>
 
   @{exec_path} mr,
 

apparmor.d/profiles-s-z/torsocks

@@ -18,6 +18,7 @@ profile torsocks @{exec_path} {
 
   @{bin}/{,ba,da}sh  rix,
   @{bin}/*          rPUx,
+  @{lib}/uwt/uwtexec rPUx,
   @{bin}/getcap      rix,
 
   /etc/tor/torsocks.conf r,