diff --git a/apparmor.d/groups/freedesktop/xdg-mime b/apparmor.d/groups/freedesktop/xdg-mime index 899e2e64..acbab312 100644 --- a/apparmor.d/groups/freedesktop/xdg-mime +++ b/apparmor.d/groups/freedesktop/xdg-mime @@ -31,7 +31,7 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) { @{bin}/gio rPx, @{bin}/mimetype rPx, @{bin}/xprop rPx, - @{bin}/ktraderclient5 rPx, + @{bin}/ktraderclient5 rPUx, /usr/share/terminfo/** r, diff --git a/apparmor.d/groups/systemd/systemd-generator-gpt-auto b/apparmor.d/groups/systemd/systemd-generator-gpt-auto index 31de7408..051a8b6f 100644 --- a/apparmor.d/groups/systemd/systemd-generator-gpt-auto +++ b/apparmor.d/groups/systemd/systemd-generator-gpt-auto @@ -24,6 +24,8 @@ profile systemd-generator-gpt-auto @{exec_path} flags=(attach_disconnected) { @{run}/systemd/generator.late/**.{,auto}mount w, @{run}/systemd/generator.late/local-fs.target.wants/ w, + @{sys}/firmware/efi/efivars/LoaderDevicePartUUID-@{uuid} r, + @{PROC}/@{pid}/cgroup r, include if exists diff --git a/apparmor.d/groups/systemd/systemd-logind b/apparmor.d/groups/systemd/systemd-logind index ca83800f..7879d2a1 100644 --- a/apparmor.d/groups/systemd/systemd-logind +++ b/apparmor.d/groups/systemd/systemd-logind @@ -75,6 +75,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) { @{run}/udev/data/c21:@{int} r, # Generic SCSI access @{run}/udev/data/c29:[0-9]* r, # For /dev/fb[0-9]* @{run}/udev/data/c81:@{int} r, # For video4linux + @{run}/udev/data/c89:[0-9]* r, # For I2C bus interface @{run}/udev/data/c116:@{int} r, # For ALSA @{run}/udev/data/c226:@{int} r, # For /dev/dri/card* @{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511 diff --git a/apparmor.d/profiles-m-r/power-profiles-daemon b/apparmor.d/profiles-m-r/power-profiles-daemon index 98c20a58..27908141 100644 --- a/apparmor.d/profiles-m-r/power-profiles-daemon +++ b/apparmor.d/profiles-m-r/power-profiles-daemon @@ -26,12 +26,16 @@ profile power-profiles-daemon @{exec_path} flags=(attach_disconnected) { /var/lib/power-profiles-daemon/{,**} rw, + @{run}/udev/data/+platform:* r, + @{sys}/bus/ r, @{sys}/bus/platform/devices/ r, @{sys}/class/ r, @{sys}/class/power_supply/ r, + @{sys}/devices/@{pci}/uevent r, @{sys}/devices/**/power_supply/*/scope r, @{sys}/devices/**/power_supply/*/uevent r, + @{sys}/devices/platform/**/uevent r @{sys}/devices/system/cpu/*_pstate/{no_turbo,turbo_pct} r, @{sys}/devices/system/cpu/*_pstate/status r, @{sys}/devices/system/cpu/cpu@{int}/power/energy_perf_bias rw,