Profile update.

apparmor.d/abstractions/disks-read

@@ -16,6 +16,7 @@
   @{sys}/devices/pci[0-9]*/**/{usb,ata}[0-9]/** r,
 
   # SSD Nvme devices
+  /dev/nvme* rk,
   @{sys}/devices/pci[0-9]*/**/nvme/nvme[0-9]*/{,**} r,
 
   # SD card devices

apparmor.d/abstractions/wayland.d/complete

@@ -4,5 +4,5 @@
 # SPDX-License-Identifier: GPL-2.0-only
 
   owner @{run}/user/@{uid}/wayland-[0-9]* rw,
-  owner @{run}/user/@{uid}/{mesa,mutter,sdl,wayland-cursor,weston,xwayland}-shared-* rw,
+        @{run}/user/@{uid}/{mesa,mutter,sdl,wayland-cursor,weston,xwayland}-shared-* rw,
   owner /dev/shm/wlroots-* rw,

apparmor.d/groups/browsers/chromium-chromium

@@ -200,6 +200,7 @@ profile chromium-chromium @{exec_path} {
   profile open {
     include <abstractions/base>
     include <abstractions/xdg-open>
+    include <abstractions/app-launcher-user>
 
     /{usr/,}bin/xdg-open mr,
 

apparmor.d/groups/desktop/dconf-service

@@ -7,12 +7,14 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = /{usr/,}lib/dconf/dconf-service /usr/{lib,libexec}/dconf-service
-profile dconf-service @{exec_path} {
+profile dconf-service @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
 
   # Needed?
   deny capability sys_nice,
 
+  signal (receive) set=term peer=gdm,
+
   @{exec_path} mr,
 
   owner @{run}/user/@{uid}/dconf/ rw,
@@ -24,8 +26,11 @@ profile dconf-service @{exec_path} {
   owner @{user_cache_dirs}/ rw,
   owner @{user_cache_dirs}/dconf/ rw,
   owner @{user_cache_dirs}/dconf/user rw,
+  /var/lib/gdm/.config/dconf/user r,
 
   @{PROC}/cmdline r,
 
+  /dev/tty[0-9]* rw,
+
   include if exists <local/dconf-service>
 }

apparmor.d/groups/gnome/gnome-session-binary

@@ -16,7 +16,6 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
 
   signal (send) set=(term) peer=gsd-*,
   signal (receive) set=(term, hup) peer=gdm*,
-  signal (receive) set=(term) peer=gdm-wayland-session,
 
   @{exec_path} mr,
 

apparmor.d/groups/gnome/gnome-shell

@@ -33,6 +33,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   signal (receive) set=(term, hup) peer=gdm*,
   signal (send) set=(usr1) peer=ibus-daemon,
   signal (send) set=(term) peer=polkit*,
+  signal (send) set=(term) peer=xwayland,
 
   @{exec_path} mr,
 
@@ -126,7 +127,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   @{sys}/devices/pci[0-9]*/**/boot_vga r,
   @{sys}/devices/pci[0-9]*/**/input[0-9]*/{properties,name} r,
   @{sys}/devices/pci[0-9]*/**/net/*/statistics/{rx_bytes,tx_bytes} r,
-  @{sys}/devices/pci[0-9]*/drm/ r,
+  @{sys}/devices/pci[0-9]*/**/drm/ r,
 
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/cgroup r,

apparmor.d/groups/gnome/gnome-shell-hotplug-sniffer

@@ -12,5 +12,7 @@ profile gnome-shell-hotplug-sniffer @{exec_path} {
 
   @{exec_path} mr,
 
+  /usr/share/mime/mime.cache r,
+
   include if exists <local/gnome-shell-hotplug-sniffer>
 }

apparmor.d/groups/gnome/gsd-housekeeping

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}lib/gsd-housekeeping
 profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/app-launcher-user>
   include <abstractions/thumbnails-cache-read>
 
   signal (receive) set=(term, hup) peer=gdm*,

apparmor.d/groups/gpg/gpg-agent

@@ -17,6 +17,7 @@ profile gpg-agent @{exec_path} {
   @{exec_path} mr,
 
   /{usr/,}lib/gnupg/scdaemon rPx,
+  /{usr/,}bin/pinentry-*     rPx,
 
   /usr/share/gnupg/* r,
 
@@ -47,9 +48,6 @@ profile gpg-agent @{exec_path} {
 
   @{PROC}/@{pid}/fd/ r,
 
-  # PIN-entry apps
-  /{usr/,}bin/pinentry-* rPx,
-
   # file_inherit
   owner @{HOME}/.xsession-errors w,
 

apparmor.d/groups/gpg/gpgconf

@@ -24,6 +24,7 @@ profile gpgconf @{exec_path} {
   /{usr/,}bin/pinentry-*        rPx,
 
   owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
+  owner @{HOME}/@{XDG_PROJECTS_DIR}/**/gnupg/** rwkl -> @{HOME}/@{XDG_PROJECTS_DIR}/**/gnupg/**,
 
   owner @{PROC}/@{pid}/task/@{tid}/stat rw,
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,

apparmor.d/groups/gpg/gpgsm

@@ -16,6 +16,7 @@ profile gpgsm @{exec_path} {
   deny /usr/bin/.gnupg/ w,
 
   owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
+  owner @{HOME}/@{XDG_PROJECTS_DIR}/**/gnupg/** rwkl -> @{HOME}/@{XDG_PROJECTS_DIR}/**,
 
   owner /var/lib/*/.gnupg/** rwkl -> /var/lib/*/.gnupg/**,
 

apparmor.d/profiles-a-l/dkms

@@ -17,6 +17,8 @@ profile dkms @{exec_path} {
   capability setgid,
   capability setuid,
 
+  unix (receive) type=stream,
+
   @{exec_path} r,
   /{usr/,}bin/{,ba,da}sh rix,
 
@@ -63,7 +65,7 @@ profile dkms @{exec_path} {
   /{usr/,}lib/modules/*/updates/ rw,
   /{usr/,}lib/modules/*/updates/dkms/ rw,
   /{usr/,}lib/modules/*/updates/dkms/*.ko rw,
-  /{usr/,}lib/modules/*/kernel/drivers/{,*.**.ko.xz} rw,
+  /{usr/,}lib/modules/*/kernel/drivers/{,*,*/,**.ko.xz} rw,
 
   /var/lib/dkms/ r,
   /var/lib/dkms/** rw,

apparmor.d/profiles-a-l/gio-querymodules

@@ -13,7 +13,7 @@ profile gio-querymodules @{exec_path} {
 
   @{exec_path} mr,
 
-  /{usr/,}/lib/gtk-{3,4}.0/**/giomodule.cache{,.[0-9A-Z]*} w,
+  /{usr/,}lib/gtk-{3,4}.0/**/giomodule.cache{,.[0-9A-Z]*} w,
 
   include if exists <local/gio-querymodules>
 }

apparmor.d/profiles-a-l/groupadd

@@ -22,6 +22,7 @@ profile groupadd @{exec_path} {
   network netlink raw,
 
   @{exec_path} mr,
+  /{usr/,}{s,}bin/nscd rix,
 
   /etc/login.defs r,
 

apparmor.d/profiles-a-l/install-info

@@ -10,13 +10,17 @@ include <tunables/global>
 profile install-info @{exec_path} {
   include <abstractions/base>
 
+  capability dac_read_search,
+
   @{exec_path} mr,
 
   /{usr/,}bin/{,ba,da}sh   rix,
-  /{usr/,}/bin/gzip        rix,
+  /{usr/,}bin/gzip         rix,
 
   /usr/share/info/{,**} r,
   /usr/share/info/dir rw,
 
+  /dev/tty rw,
+
   include if exists <local/install-info>
 }

apparmor.d/profiles-a-l/kmod

@@ -26,8 +26,7 @@ profile kmod @{exec_path} {
   # than to standard error.
   capability syslog,
 
-  unix (receive) type=stream peer=(label=depmod),
-  unix (receive) type=stream peer=(label=modprobe),
+  unix (receive) type=stream,
 
   @{exec_path} mr,