Profiles update.

apparmor.d/groups/browsers/chromium-chromium

@@ -21,7 +21,7 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
   include <abstractions/gtk>
   include <abstractions/mesa>
   include <abstractions/nameservice-strict>
-  include <abstractions/opencl-intel>
+  include <abstractions/opencl>
   include <abstractions/ssl_certs>
   include <abstractions/thumbnails-cache-read>
   include <abstractions/user-download-strict>

apparmor.d/groups/bus/ibus-extension-gtk3

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}lib/ibus/ibus-extension-gtk3
 profile ibus-extension-gtk3 @{exec_path} {
   include <abstractions/base>
+  include <abstractions/dconf>
   include <abstractions/fontconfig-cache-write>
   include <abstractions/fonts>
   include <abstractions/gtk>
@@ -24,6 +25,7 @@ profile ibus-extension-gtk3 @{exec_path} {
 
   @{exec_path} mr,
 
+  /usr/share/dconf/profile/gdm r,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /usr/share/ibus/{,**} r,
   /usr/share/icons/{,**} r,
@@ -34,13 +36,12 @@ profile ibus-extension-gtk3 @{exec_path} {
   owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
   owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-[0-9] r,
 
-  include <abstractions/dconf>
+  owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* r,
+  owner @{run}/user/@{uid}/gdm/Xauthority r,
+
   owner @{run}/user/@{uid}/dconf/ rw,
   owner @{run}/user/@{uid}/dconf/user rw,
-  /usr/share/dconf/profile/gdm r,
   /var/lib/gdm/.config/dconf/user r,
 
-  owner @{run}/user/@{uid}/gdm/Xauthority r,
-
   include if exists <local/ibus-extension-gtk3>
 }

apparmor.d/groups/bus/ibus-x11

@@ -15,6 +15,7 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) {
   include <abstractions/gtk>
   include <abstractions/mesa>
   include <abstractions/nameservice-strict>
+  include <abstractions/opencl>
 
   @{exec_path} mr,
 

apparmor.d/groups/gnome/evolution-alarm-notify

@@ -12,6 +12,7 @@ profile evolution-alarm-notify @{exec_path} {
   include <abstractions/fontconfig-cache-read>
   include <abstractions/gnome>
   include <abstractions/nameservice-strict>
+  include <abstractions/opencl>
   include <abstractions/openssl>
 
   @{exec_path} mr,

apparmor.d/groups/gnome/gjs-console

@@ -57,6 +57,8 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
         @{run}/user/@{uid}/wayland-cursor-shared-* rw,
 
   @{sys}/devices/pci[0-9]*/**/drm/ r,
+  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/id r,
+  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/gt_*_mhz r,
 
   /dev/ r,
   /dev/tty rw,

apparmor.d/groups/gnome/gnome-calendar

@@ -11,6 +11,7 @@ profile gnome-calendar @{exec_path} {
   include <abstractions/base>
   include <abstractions/gnome>
   include <abstractions/nameservice-strict>
+  include <abstractions/opencl>
   include <abstractions/openssl>
   include <abstractions/p11-kit>
   include <abstractions/ssl_certs>

apparmor.d/groups/gnome/gnome-contacts-search-provider

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}lib/gnome-contacts-search-provider
 profile gnome-contacts-search-provider @{exec_path} {
   include <abstractions/base>
+  include <abstractions/opencl>
   include <abstractions/openssl>
 
   signal (send) set=(term) peer=unconfined,

apparmor.d/groups/gnome/goa-daemon

@@ -10,6 +10,7 @@ include <tunables/global>
 profile goa-daemon @{exec_path} {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
+  include <abstractions/opencl>
   include <abstractions/openssl>
   include <abstractions/p11-kit>
   include <abstractions/ssl_certs>

apparmor.d/groups/gnome/gsd-xsettings

@@ -15,6 +15,7 @@ profile gsd-xsettings @{exec_path} {
   include <abstractions/fonts>
   include <abstractions/gtk>
   include <abstractions/nameservice-strict>
+  include <abstractions/opencl>
 
   network inet stream,
   network inet6 stream,

apparmor.d/groups/gnome/nautilus

@@ -28,6 +28,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
 
   # Full access to user's data
   / r,
+  /home/ r,
   owner @{HOME}/{,**} rw,
   owner @{MOUNTS}/{,**} rw,
   owner @{run}/user/@{uid}/{,**} rw,
@@ -46,7 +47,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
 
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mountinfo r,
-  owner @{PROC}/@{pid}/net/wireless r,
+        @{PROC}/@{pids}/net/wireless r,
 
   @{run}/mount/utab r,
   @{run}/systemd/userdb/ r,

apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor

@@ -23,6 +23,8 @@ profile gvfs-udisks2-volume-monitor @{exec_path} {
 
   signal (send) set=(term, kill) peer=mount,
 
+  ptrace (read),
+
   @{exec_path} mr,
 
   /{usr/,}bin/lsof   rix,
@@ -51,10 +53,12 @@ profile gvfs-udisks2-volume-monitor @{exec_path} {
 
   owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/fdinfo/[0-9]* r,
   owner @{PROC}/@{pid}/mountinfo r,
   owner @{PROC}/@{pid}/mounts r,
-  owner @{PROC}/@{pid}/stat r,
+  owner @{PROC}/@{pid}/net/* r,
         @{PROC}/ r,
+        @{PROC}/@{pid}/stat r,
         @{PROC}/1/cgroup r,
         @{PROC}/locks r,
 

apparmor.d/groups/network/NetworkManager

@@ -13,15 +13,6 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
 
-  network inet stream,
-  network inet6 stream,
-  network inet dgram,
-  network inet6 dgram,
-  network inet raw,
-  network inet6 raw,
-  network netlink raw,
-  network packet dgram,
-
   capability audit_write,
   capability dac_override,
   capability kill,
@@ -33,6 +24,15 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
   capability sys_chroot,
   capability sys_module,
 
+  network inet stream,
+  network inet6 stream,
+  network inet dgram,
+  network inet6 dgram,
+  network inet raw,
+  network inet6 raw,
+  network netlink raw,
+  network packet dgram,
+
   @{exec_path} mr,
 
   /{usr/,}bin/{,ba,da}sh rix,

apparmor.d/groups/network/nm-dhcp-helper

@@ -10,7 +10,19 @@ include <tunables/global>
 profile nm-dhcp-helper @{exec_path} {
   include <abstractions/base>
 
+  network inet dgram,
+  network inet6 dgram,
+
+  ptrace (readby) peer=NetworkManager,
+
+  signal (receive) peer=NetworkManager,
+  signal (send) peer=dhclient,
+
   @{exec_path} mr,
 
+  /var/lib/NetworkManager/*lease r,
+
+  @{run}/NetworkManager/private-dhcp rw,
+
   include if exists <local/nm-dhcp-helper>
 }

apparmor.d/groups/network/tailscaled

@@ -42,14 +42,14 @@ profile tailscaled @{exec_path} {
   @{PROC}/ r,
   @{PROC}/@{pid}/mounts r,
   @{PROC}/@{pid}/net/{,**} r,
-  @{PROC}/sys/net/{,**} r,
   @{PROC}/@{pids}/cmdline r,
   @{PROC}/@{pids}/fd/ r,
   @{PROC}/1/cgroup r,
-  @{PROC}/1/stat r,
   @{PROC}/1/environ r,
+  @{PROC}/1/stat r,
   @{PROC}/cmdline r,
   @{PROC}/sys/kernel/osrelease r,
+  @{PROC}/sys/net/{,**} r,
 
   /dev/net/tun rw,
 

apparmor.d/groups/pacman/pacman

@@ -57,6 +57,7 @@ profile pacman @{exec_path} {
   /{usr/,}bin/gettext                     rix,
   /{usr/,}bin/ghc-pkg-*                   rix,
   /{usr/,}bin/grep                        rix,
+  /{usr/,}bin/iscsi-iname                 rix,
   /{usr/,}bin/killall                     rix,
   /{usr/,}bin/rm                          rix,
   /{usr/,}bin/setcap                      rix,

apparmor.d/groups/systemd/systemd-binfmt

@@ -17,14 +17,15 @@ profile systemd-binfmt @{exec_path} {
   @{exec_path} mr,
 
   # Config file locations
-  /etc/binfmt.d/*.conf r,
+  /etc/binfmt.d/{,*.conf} r,
-  @{run}/binfmt.d/*.conf r,
+  @{run}/binfmt.d/{,*.conf} r,
-  /usr/lib/binfmt.d/*.conf r,
+  /usr/lib/binfmt.d/{,*.conf} r,
 
   owner @{PROC}/@{pid}/stat r,
         @{PROC}/1/environ r,
         @{PROC}/cmdline r,
         @{PROC}/sys/fs/binfmt_misc/status w,
+        @{PROC}/sys/fs/binfmt_misc/register w,
         @{PROC}/sys/kernel/osrelease r,
 
   include if exists <local/systemd-binfmt>

apparmor.d/profiles-a-f/aa-log

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}bin/aa-log
 profile aa-log @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
 
   @{exec_path} mr,
 

apparmor.d/profiles-a-f/fwupd

@@ -31,20 +31,22 @@ profile fwupd @{exec_path} flags=(complain,attach_disconnected) {
   /{usr/,}bin/gpgconf     rCx -> gpg,
   /{usr/,}bin/gpgsm       rCx -> gpg,
 
+  /usr/share/fwupd/{,**} r,
+  /usr/share/mime/mime.cache r,
+
   /etc/pki/fwupd/{,**} r,
   /etc/pki/fwupd-metadata/{,**} r,
   /etc/fwupd/{,**} r,
-  /usr/share/fwupd/{,**} r,
+  /etc/fwupd/remotes.d/* rw,
 
   /var/cache/fwupd/{,**} rw,
   /var/lib/fwupd/{,**} rw,
   /var/lib/fwupd/pending.db rwk,
 
   /boot/{,**} r,
-  /boot/EFI/arch/fwupdx[0-9]*.efi rw,
+  /boot/EFI/*/.goutputstream-* rw,
-  /boot/EFI/arch/fw/fwupd-*.cap{,.*} rw,
+  /boot/EFI/*/fw/fwupd-*.cap{,.*} rw,
-
+  /boot/EFI/*/fwupdx[0-9]*.efi rw,
-  /usr/share/mime/mime.cache r,
 
   /etc/machine-id r,
   /var/lib/dbus/machine-id r,

apparmor.d/profiles-g-l/glxinfo

@@ -13,6 +13,7 @@ profile glxinfo @{exec_path} {
   include <abstractions/dri-enumerate>
   include <abstractions/mesa>
   include <abstractions/nameservice-strict>
+  include <abstractions/opencl>
 
   capability sys_admin,
   # Needed?

apparmor.d/profiles-g-l/htop

@@ -90,6 +90,7 @@ profile htop @{exec_path} {
   @{sys}/devices/**/hwmon/**/{name,temp*} r,
   @{sys}/devices/**/power_supply/**/{uevent,type,online} r,
   @{sys}/devices/*/name r,
+  @{sys}/devices/i2c-[0-9]*/name r,
   @{sys}/devices/pci[0-9]*/**/i2c-[0-9]*/name r,
   @{sys}/devices/system/cpu/cpu[0-9]*/online r,
   @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_cur_freq r,

apparmor.d/profiles-s-z/xdg-dbus-proxy

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}bin/xdg-dbus-proxy
-profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected, complain) {
+profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
 
   @{exec_path} mr,
@@ -15,8 +15,10 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected, complain) {
   owner @{user_share_dirs}/gvfs-metadata/{,*} r,
 
   owner @{run}/firejail/dbus/[0-9]*/[0-9]*-user rw,
-  owner @{run}/user/@{uid}/webkitgtk/dbus-proxy-[0-9A-Z]* rw,
   owner @{run}/user/@{uid}/.dbus-proxy/{session,a11y}-bus-proxy-[0-9A-Z]* rw,
+  owner @{run}/user/@{uid}/webkitgtk/a11y-proxy-[0-9A-Z]* rw,
+  owner @{run}/user/@{uid}/webkitgtk/bus-proxy-[0-9A-Z]* rw,
+  owner @{run}/user/@{uid}/webkitgtk/dbus-proxy-[0-9A-Z]* rw,
 
   @{sys}/devices/virtual/thermal/thermal_zone[0-9]/hwmon[0-9]/temp* r,
 

apparmor.d/profiles-s-z/xorg

@@ -13,14 +13,13 @@ include <tunables/global>
 @{exec_path} += /{usr/,}lib/xorg/Xorg
 profile xorg @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
-  include <abstractions/opencl-intel>
-  include <abstractions/opencl-nvidia>
-  include <abstractions/vulkan>
-  include <abstractions/fonts>
   include <abstractions/fontconfig-cache-read>
+  include <abstractions/fonts>
   include <abstractions/freedesktop.org>
   include <abstractions/mesa>
   include <abstractions/nameservice-strict>
+  include <abstractions/opencl>
+  include <abstractions/vulkan>
 
   capability setgid,
   capability setuid,
@@ -66,7 +65,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
   owner @{user_share_dirs}/xorg/Xorg.[0-9].log{,.old} rw,
   owner @{user_share_dirs}/xorg/Xorg.pid-@{pid}.log{,.old} rw,
 
-  owner /var/lib/gdm/.local/share/xorg/Xorg.pid-@{pid}.log{,.old} rw,
+        /var/lib/gdm/.local/share/xorg/Xorg.pid-@{pid}.log{,.old} rw,
   owner /var/log/lightdm/x-*.log* rw,
   owner /var/log/Xorg.[0-9].log{,.old} rw,
   owner /var/log/Xorg.pid-@{pid}.log{,.old} rw,