Profile update.

apparmor.d/abstractions/gstreamer

@@ -44,6 +44,7 @@
   #owner @{HOME}/orcexec.* mrw,
 
   /{usr/,}lib/frei0r-[0-9]/*.so mr,
+  /{usr/,}lib/gstreamer-[0-9]*.[0-9]*/gst-plugin-scanner mrix,
   /{usr/,}lib/@{multiarch}/gstreamer[0-9]*.[0-9]*/gstreamer-[0-9]*.[0-9]*/gst-plugin-scanner mrix,
   /{usr/,}lib/@{multiarch}/libproxy/*/modules/*.so mr,
   /{usr/,}lib/@{multiarch}/libproxy/*/pxgsettings ixr,

apparmor.d/abstractions/python.d/complete

@@ -13,4 +13,4 @@
   owner @{user_lib_dirs}/python{2.[4-7],3,3.[0-9]}/{site,dist}-packages/**/ r,
 
   # Silencer
-  /{usr/,}lib/python3/** w,
+  /{usr/,}lib/python{2.[4-7],3,3.[0-9]}/** w,

apparmor.d/abstractions/user-read

@@ -1,6 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
-# SPDX-License-Identifier: GPL-3.0-or-later
+# SPDX-License-Identifier: GPL-2.0-only
 
   owner @{HOME}/@{XDG_DOCUMENTS_DIR}/{,**} r,
   owner @{HOME}/@{XDG_MUSIC_DIR}/{,**} r,

apparmor.d/groups/desktop/blueman

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}bin/blueman-*
-profile blueman @{exec_path} {
+profile blueman @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/python>
   include <abstractions/fonts>
@@ -78,6 +78,9 @@ profile blueman @{exec_path} {
 
   @{run}/user/1000/gdm/Xauthority r,
 
+  # file_inherit
+  /dev/dri/card[0-9]* rw,
+
   profile open {
     include <abstractions/base>
     include <abstractions/xdg-open>

apparmor.d/groups/desktop/blueman-mechanism

@@ -13,6 +13,7 @@ profile blueman-mechanism @{exec_path} {
   include <abstractions/python>
   include <abstractions/nameservice-strict>
 
+  capability mknod,
   capability net_admin,
   deny capability sys_nice,
 

apparmor.d/groups/desktop/xwayland

@@ -9,6 +9,8 @@ include <tunables/global>
 @{exec_path}  = /{usr/,}bin/Xwayland
 profile xwayland @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/dri-common>
+  include <abstractions/dri-enumerate>
   include <abstractions/mesa>
   include <abstractions/nameservice-strict>
 
@@ -19,13 +21,9 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
   /{usr/,}bin/{,ba,da}sh rix,
   /{usr/,}bin/xkbcomp    rPx,
 
-  /usr/share/drirc.d/{,*} r,
   /usr/share/glvnd/egl_vendor.d/{,*.json} r,
   /usr/share/X11/xkb/rules/evdev r,
 
-  /dev/dri/card[0-9]* rw,
-  /dev/dri/renderD[0-9]* rw,
-
   # TMP files
   owner /tmp/server-[0-9]*.xkm rwk,
 
@@ -36,12 +34,6 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
   # Needed for Mutter
   owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[a-zA-z0-9]* rw,
 
-  @{sys}/devices/pci[0-9]*/**/uevent r,
-  @{sys}/devices/pci[0-9]*/**/vendor r,
-  @{sys}/devices/pci[0-9]*/**/device r,
-  @{sys}/devices/pci[0-9]*/**/subsystem_vendor r,
-  @{sys}/devices/pci[0-9]*/**/subsystem_device r,
-
   owner @{PROC}/@{pids}/cmdline r,
 
   include if exists <local/xwayland>

apparmor.d/groups/glib/glib-pacrunner

@@ -17,5 +17,8 @@ profile glib-pacrunner @{exec_path} {
 
   @{exec_path} mr,
 
+  @{PROC}/cmdline r,
+  @{PROC}/sys/kernel/osrelease r,
+
   include if exists <local/glib-pacrunner>
 }

apparmor.d/groups/gnome/gio-launch-desktop

@@ -25,6 +25,8 @@ profile gio-launch-desktop @{exec_path} {
 
   # User files
   owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/mountinfo r,
+  owner @{PROC}/@{pid}/mounts r,
 
   # file_inherit
   owner @{HOME}/.xsession-errors w,

apparmor.d/profiles-a-l/child-pager

@@ -18,6 +18,9 @@ profile child-pager {
   include <abstractions/base>
   include <abstractions/consoles>
 
+  capability dac_override,
+  capability dac_read_search,
+
   signal (receive) set=(stop, cont, term, kill),
 
   /{usr/,}bin/       r,

apparmor.d/profiles-m-z/virt-manager

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2020-2021 Mikhail Morfikov
+#               2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -63,16 +64,16 @@ profile virt-manager @{exec_path} {
   # User VM images
   owner @{user_share_dirs}/libvirt/{,**} rw,
   owner @{HOME}/@{XDG_VM_DIR}/{,**} rw,
-
+  owner @{MOUNTS}/*/@{XDG_VM_DIR}/{,**} rw,
-  #owner /media/*/VM/ r,
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
   /usr/share/osinfo/{,**} r,
   /usr/share/gtksourceview-4/{,**} r,
 
-  /usr/share/misc/pci.ids r,
+  /usr/share/hwdata/*.ids r,
-  /var/lib/usbutils/usb.ids r,
+  /usr/share/misc/*.ids r,
+  /var/lib/usbutils/*.ids r,
 
   owner @{PROC}/@{pid}/mountinfo r,
   owner @{PROC}/@{pid}/mounts r,

apparmor.d/tunables/xdg-user-dirs.d/complete

@@ -49,4 +49,4 @@
 # User build directories and output
 @{user_build_dirs}="/tmp/build"
 @{user_pkg_dirs}="/tmp/pkg/"
-@{user_tmp_dirs}="/run/user/1000" "/tmp"
+@{user_tmp_dirs}="/run/user/@{uid}" "/tmp"