feat(profiles): general update.

apparmor.d/groups/gnome/gdm-wayland-session

@@ -39,20 +39,22 @@ profile gdm-wayland-session @{exec_path} {
   @{exec_path} mr,
 
   /{usr/,}bin/{,ba,da}sh           rix,
+  /{usr/,}bin/cat                  rix,
   /{usr/,}bin/env                  rix,
   /{usr/,}bin/gettext              rix,
   /{usr/,}bin/gnome-session        rix,
   /{usr/,}bin/grep                 rix,
   /{usr/,}bin/gsettings            rix,
   /{usr/,}bin/head                 rix,
+  /{usr/,}bin/id                   rix,
   /{usr/,}bin/locale               rix,
   /{usr/,}bin/locale-check         rix,
   /{usr/,}bin/qmake                rix,
   /{usr/,}bin/sed                  rix,
   /{usr/,}bin/sort                 rix,
+  /{usr/,}bin/tr                   rix,
   /{usr/,}bin/tty                  rix,
   /{usr/,}bin/zsh                  rix,
-  /{usr/,}bin/id                   rix,
 
   /{usr/,}bin/dbus-daemon          rPx,
   /{usr/,}bin/dbus-run-session     rPx,
@@ -63,6 +65,7 @@ profile gdm-wayland-session @{exec_path} {
   /{usr/,}bin/gettext.sh r,
   /usr/share/im-config/{,**} r,
 
+  /etc/debuginfod/{,*} r,
   /etc/default/im-config r,
   /etc/gdm{3,}/custom.conf r,
   /etc/gdm{3,}/daemon.conf r,

apparmor.d/groups/gnome/gnome-tweaks

@@ -28,9 +28,12 @@ profile gnome-tweaks @{exec_path} {
 
   /etc/xdg/autostart/{,**} r,
 
+  owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
+
   owner @{user_cache_dirs}/thumbnails/{,**} r,
   owner @{user_config_dirs}/autostart/ rw,
   owner @{user_config_dirs}/autostart/*.desktop r,
+  owner @{user_config_dirs}/gtk-{3,4}.0/settings.ini* rw,
   owner @{user_share_dirs}/backgrounds/{,**} r,
   owner @{user_share_dirs}/gnome-shell/extensions/**/schemas/* r,
   owner @{user_share_dirs}/recently-used.xbel* rw,

apparmor.d/groups/grub/grub-check-signatures

@@ -18,6 +18,10 @@ profile grub-check-signatures @{exec_path} {
   /{usr/,}bin//mktemp      rix,
   /{usr/,}bin//od          rix,
 
+  /usr/share/debconf/frontend rPx,
+
+  /usr/share/debconf/confmodule r,
+
   owner /tmp/tmp.*/ rw,
 
   include if exists <local/grub-check-signatures>

apparmor.d/groups/grub/grub-multi-install

@@ -21,10 +21,12 @@ profile grub-multi-install @{exec_path} {
   /{usr/,}bin/readlink           rix,
   /{usr/,}bin/sed                rix,
   /{usr/,}bin/sort               rix,
-  /{usr/,}bin/udevadm            rPx,
   /{usr/,}bin/touch              rix,
+  /{usr/,}bin/udevadm            rPx,
+  /usr/share/debconf/frontend    rPx,
 
   /usr/lib/terminfo/x/xterm-256color r,
+  /usr/share/debconf/confmodule r,
 
   /boot/grub/grub.cfg rw,
 

apparmor.d/groups/pacman/aurpublish

@@ -28,9 +28,11 @@ profile aurpublish @{exec_path} {
   /{usr/,}bin/nproc       rix,
   /{usr/,}bin/rm          rix,
   /{usr/,}bin/sha512sum   rix,
+  /{usr/,}bin/tput        rix,
   /{usr/,}bin/wc          rix,
 
   /usr/share/makepkg/{,**} r,
+  /usr/share/terminfo/x/xterm-256color r,
 
   /etc/makepkg.conf r,
 

apparmor.d/groups/systemd/coredumpctl

@@ -12,6 +12,8 @@ profile coredumpctl @{exec_path} flags=(complain) {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
 
+  capability net_admin,
+
   signal (send) peer=child-pager,
 
   @{exec_path} mr,

apparmor.d/groups/systemd/networkctl

@@ -54,6 +54,7 @@ profile networkctl @{exec_path} flags=(attach_disconnected,complain) {
   @{sys}/devices/**/net/**/uevent r,
 
         @{PROC}/sys/kernel/random/boot_id r,
+        @{PROC}/1/cgroup r,
   owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/stat r,
 

apparmor.d/groups/systemd/systemd-logind

@@ -140,8 +140,8 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
   /dev/dri/card[0-9]* rw,
   /dev/input/event[0-9]* rw,  # Input devices (keyboard, mouse, etc)
   /dev/mqueue/ r,
-  /dev/shm/{,**/} rw,
   /dev/tty[0-9]* rw,
+  owner /dev/shm/{,**/} rw,
 
   include if exists <local/systemd-logind>
 }

apparmor.d/groups/systemd/systemd-tty-ask-password-agent

@@ -10,6 +10,7 @@ include <tunables/global>
 profile systemd-tty-ask-password-agent @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
+  include <abstractions/systemd-common>
 
 #  capability net_admin,
 
@@ -18,12 +19,10 @@ profile systemd-tty-ask-password-agent @{exec_path} {
   @{exec_path} mr,
 
   @{run}/systemd/ask-password-block/{,*} rw,
-  @{run}/systemd/ask-password/ r,
+  @{run}/systemd/ask-password/{,*} rw,
+  @{run}/utmp rk,
 
   @{PROC}/@{pids}/stat r,
-  @{PROC}/sys/kernel/osrelease r,
-  @{PROC}/cmdline r,
-  @{PROC}/1/environ r,
 
   include if exists <local/systemd-tty-ask-password-agent>
 }

apparmor.d/groups/systemd/systemd-udevd

@@ -38,18 +38,22 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
 
   /{usr/,}bin/{,ba,da}sh        rix,
   /{usr/,}bin/{,e}grep          rix,
+  /{usr/,}bin/cat               rix,
   /{usr/,}bin/chgrp             rix,
   /{usr/,}bin/chmod             rix,
+  /{usr/,}bin/cut               rix,
   /{usr/,}bin/ln                rix,
   /{usr/,}bin/logger            rix,
+  /{usr/,}bin/mknod             rPx,
   /{usr/,}bin/nohup             rix,
   /{usr/,}bin/perl              rix,
   /{usr/,}bin/readlink          rix,
   /{usr/,}bin/setfacl           rix,
-  /{usr/,}bin/unshare           rix,
   /{usr/,}bin/snap              rPx,
+  /{usr/,}bin/unshare           rix,
 
-  /{usr/,}{s,}bin/*             rPUx,
+  /{usr/,}{s,}bin/*             rpux,
+  audit /{usr/,}{s,}bin/lvm      rux,
 
   /{usr/,}lib/pm-utils/power.d/*          rPUx,
   /{usr/,}lib/snapd/snap-device-helper     rPx,
@@ -82,7 +86,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
   /etc/systemd/network/[0-9][0-9]-*.link r,
 
   @{run}/udev/ rw,
-  @{run}/udev/** rw,
+  @{run}/udev/** rwk,
 
   @{run}/systemd/network/ r,
   @{run}/systemd/notify rw,
@@ -90,12 +94,13 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
 
   @{sys}/** rw,
 
-  owner @{PROC}/@{pid}/loginuid r,
-  owner @{PROC}/@{pid}/oom_score_adj rw,
-  owner @{PROC}/@{pid}/fd/ r,
         @{PROC}/@{pids}/cgroup r,
         @{PROC}/devices r,
         @{PROC}/driver/nvidia/gpus/ r,
+        @{PROC}/driver/nvidia/gpus/*/information r,
+  owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/loginuid r,
+  owner @{PROC}/@{pid}/oom_score_adj rw,
 
   /dev/ rw,
   /dev/** rwk,

apparmor.d/profiles-s-z/snap-update-ns

@@ -23,6 +23,7 @@ profile snap-update-ns @{exec_path} {
 
   /var/lib/snapd/mount/{,*} r,
 
+  /snap/{,**} rw,
   /tmp/.snap/{,**} rwk,
 
   @{run}/snapd/lock/*.lock rwk,