diff --git a/apparmor.d/groups/children/child-open b/apparmor.d/groups/children/child-open index 6759e8e6..60c04d2f 100644 --- a/apparmor.d/groups/children/child-open +++ b/apparmor.d/groups/children/child-open @@ -62,6 +62,7 @@ profile child-open { /{usr/,}bin/filezilla rPx, /{usr/,}bin/flameshot rPx, /{usr/,}bin/geany rPx, + /{usr/,}bin/gnome-calculator rPx, /{usr/,}bin/gnome-disk-image-mounter rPx, /{usr/,}bin/kgx rPUx, /{usr/,}bin/okular rPx, diff --git a/apparmor.d/groups/cron/cron-anacron b/apparmor.d/groups/cron/cron-anacron index f4aa8d12..14f6b2f3 100644 --- a/apparmor.d/groups/cron/cron-anacron +++ b/apparmor.d/groups/cron/cron-anacron @@ -12,8 +12,13 @@ profile cron-anacron @{exec_path} { @{exec_path} r, - /{usr/,}bin/{,ba,da}sh rix, /{usr/,}{s,}bin/anacron rPx, + /{usr/,}bin/{,ba,da}sh rix, + /{usr/,}bin/cat rix, + /{usr/,}bin/date rix, + + @{sys}/class/power_supply/ r, + @{sys}/devices/**/power_supply/{,**} r, include if exists } diff --git a/apparmor.d/groups/gnome/gsd-media-keys b/apparmor.d/groups/gnome/gsd-media-keys index 605ce14d..04fc7f7a 100644 --- a/apparmor.d/groups/gnome/gsd-media-keys +++ b/apparmor.d/groups/gnome/gsd-media-keys @@ -10,11 +10,12 @@ include profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { include include - include - include include + include + include include include + include include include @@ -172,6 +173,8 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { /var/lib/gdm{3,}/.config/pulse/client.conf r, /var/lib/gdm{3,}/.config/pulse/cookie rk, + /var/lib/flatpak/exports/share/applications/{,mimeinfo.cache} r, + owner @{user_config_dirs}/pulse/ rw, owner @{user_share_dirs}/ r, @@ -187,8 +190,9 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c13:[0-9]* r, # for /dev/input/* - @{sys}/devices/platform/**/uevent r, @{sys}/devices/**/usb[0-9]/{,**} r, + @{sys}/devices/platform/**/uevent r, + @{sys}/devices/virtual/**/uevent r, @{PROC}/1/cgroup r, owner @{PROC}/@{pid}/cgroup r, diff --git a/apparmor.d/groups/systemd/systemd-coredump b/apparmor.d/groups/systemd/systemd-coredump index 7595cb1f..84f369ae 100644 --- a/apparmor.d/groups/systemd/systemd-coredump +++ b/apparmor.d/groups/systemd/systemd-coredump @@ -43,6 +43,8 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected) { @{PROC}/@{pids}/fdinfo/[0-9]* r, @{PROC}/@{pids}/limits r, @{PROC}/@{pids}/mountinfo r, + @{PROC}/@{pids}/ns/ r, + @{PROC}/@{pids}/stat r, owner @{PROC}/@{pid}/setgroups r, include if exists diff --git a/apparmor.d/profiles-a-f/anacron b/apparmor.d/profiles-a-f/anacron index 73f0d81e..707267d4 100644 --- a/apparmor.d/profiles-a-f/anacron +++ b/apparmor.d/profiles-a-f/anacron @@ -21,6 +21,8 @@ profile anacron @{exec_path} { /var/spool/anacron/cron.* rwk, + @{HOME}/ r, + /tmp/file* rw, include if exists diff --git a/apparmor.d/profiles-m-r/run-parts b/apparmor.d/profiles-m-r/run-parts index 5a5859bc..0a5e940a 100644 --- a/apparmor.d/profiles-m-r/run-parts +++ b/apparmor.d/profiles-m-r/run-parts @@ -18,6 +18,8 @@ profile run-parts @{exec_path} { /usr/share/update-notifier/notify-reboot-required rPx, /usr/share/update-notifier/notify-updates-outdated rPx, + /etc/ r, + # Crontrab /etc/cron.{hourly,daily,weekly,monthly}/ r, /etc/cron.{hourly,daily,weekly,monthly}/0anacron rPUx,