Update profiles.

apparmor.d/groups/bus/ibus-dconf

@@ -20,8 +20,8 @@ profile ibus-dconf @{exec_path} flags=(attach_disconnected) {
   /etc/dconf/db/ibus r,
   /var/lib/dbus/machine-id r,
 
-  owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
+  owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
-  /var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
+  /var/lib/gdm/.config/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
 
   include <abstractions/dconf>
   owner @{run}/user/@{uid}/dconf/ rw,

apparmor.d/groups/bus/ibus-engine-simple

@@ -16,8 +16,8 @@ profile ibus-engine-simple @{exec_path} flags=(attach_disconnected) {
 
   /var/lib/dbus/machine-id r,
 
-  owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
+  owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
-  /var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
+  /var/lib/gdm/.config/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
 
   owner /dev/tty[0-9]* rw,
 

apparmor.d/groups/bus/ibus-extension-gtk3

@@ -30,7 +30,7 @@ profile ibus-extension-gtk3 @{exec_path} {
 
   /var/lib/dbus/machine-id r,
 
-  owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
+  owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
 
   include <abstractions/dconf>
   owner @{run}/user/@{uid}/dconf/ rw,

apparmor.d/groups/bus/ibus-portal

@@ -20,8 +20,8 @@ profile ibus-portal @{exec_path} flags=(attach_disconnected) {
   /usr/share/locale/locale.alias r,
 
   /var/lib/dbus/machine-id r,
-  /var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
+  /var/lib/gdm/.config/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
-  owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
+  owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
 
   owner /dev/tty[0-9]* rw,
   /dev/null rw,

apparmor.d/groups/bus/ibus-x11

@@ -20,8 +20,8 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) {
 
   /var/lib/dbus/machine-id r,
 
-  owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
+  owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
-  /var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
+  /var/lib/gdm/.config/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
 
   owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* r,
 

apparmor.d/groups/gnome/gnome-control-center

@@ -81,6 +81,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
   @{run}/udev/data/c13:[0-9]* r,    # for /dev/input/*
   @{run}/udev/data/c235:[0-9]* r,
   @{run}/udev/data/c236:[0-9]* r,
+  @{run}/udev/data/c510:[0-9]* r,
   @{run}/udev/data/n[0-9]* r,
 
   @{sys}/bus/ r,

apparmor.d/groups/gnome/gnome-shell

@@ -69,9 +69,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
 
   owner @{user_config_dirs}/.goutputstream{,*} rw,
   owner @{user_config_dirs}/ibus/* r,
-  owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
+  owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
   owner @{user_config_dirs}/monitors.xml{,~} rwl,
-  /var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
+  /var/lib/gdm/.config/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
 
   owner @{user_share_dirs}/backgrounds/{,**} rw,
   owner @{user_share_dirs}/gnome-shell/{,**} rw,

apparmor.d/groups/gnome/tracker-extract

@@ -40,6 +40,7 @@ profile tracker-extract @{exec_path} {
 
   @{run}/udev/data/c235:* r,
   @{run}/udev/data/c236:* r,
+  @{run}/udev/data/c510:* r,
 
   /dev/video[0-9]* rw,
 

apparmor.d/groups/gpg/gpg

@@ -14,6 +14,8 @@ profile gpg @{exec_path} {
   include <abstractions/user-download-strict>
   include <abstractions/nameservice-strict>
 
+  network netlink raw,
+
   @{exec_path} mrix,
 
   /{usr/,}bin/gpgconf           rPx,

apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor

@@ -36,7 +36,7 @@ profile gvfs-udisks2-volume-monitor @{exec_path} {
 
   # Mount points
   @{MOUNTS}/*/ r,
-  @{MOUNTS}/*/*/ r,
+  @{MOUNTS}/*/**/ r,
   @{HOME}/*/*/ r,
   @{HOME}/*/*/**/ r,
   @{HOME}/bluetooth/ r,

apparmor.d/groups/network/openvpn

@@ -65,7 +65,7 @@ profile openvpn @{exec_path} {
   @{run}/NetworkManager/nm-openvpn-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw,
 
   /{usr/,}bin/ip                                rix,
-  /{usr/,}bin/systemd-ask-password              rCx -> systemd-ask-password,
+  /{usr/,}bin/systemd-ask-password              rPx,
   /{usr/,}lib/nm-openvpn-service-openvpn-helper rPx,
   /etc/openvpn/force-user-traffic-via-vpn.sh    rCx -> force-user-traffic-via-vpn,
   /etc/openvpn/update-resolv-conf{,.sh}         rCx -> update-resolv,
@@ -74,18 +74,6 @@ profile openvpn @{exec_path} {
 
   owner @{PROC}/@{pid}/net/route r,
 
-
-  profile systemd-ask-password {
-    include <abstractions/base>
-    include <abstractions/consoles>
-
-    /{usr/,}bin/systemd-ask-password mr,
-
-          @{PROC}/filesystems r,
-    owner @{PROC}/@{pid}/stat r,
-
-  }
-
   profile update-resolv {
     include <abstractions/base>
     include <abstractions/consoles>

apparmor.d/groups/pacman/paccache

@@ -20,7 +20,7 @@ profile paccache @{exec_path} {
   /{usr/,}bin/cat          rix,
   /{usr/,}bin/gawk         rix,
   /{usr/,}bin/gettext      rix,
-  /{usr/,}bin/pacman       rPUx,
+  /{usr/,}bin/pacman       rPx,
   /{usr/,}bin/pacman-conf  rPx,
   /{usr/,}bin/pacsort      rix,
   /{usr/,}bin/rm           rix,

apparmor.d/groups/pacman/pacman

@@ -55,6 +55,7 @@ profile pacman @{exec_path} {
   /{usr/,}bin/install-info                rPx,
   /{usr/,}bin/killall                     rPx,
   /{usr/,}bin/pacdiff                     rPx,
+  /{usr/,}bin/pacman-key                  rPx,
   /{usr/,}bin/sysctl                      rPx,
   /{usr/,}bin/systemctl                   rPx -> child-systemctl,
   /{usr/,}bin/update-ca-trust             rPx,

apparmor.d/groups/pacman/pacman-hook-dconf

@@ -18,5 +18,11 @@ profile pacman-hook-dconf @{exec_path} {
 
   /etc/dconf/db/{,**} rw,
 
+  /dev/tty rw,
+
+  # Inherit Silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
   include if exists <local/pacman-hook-dconf>
 }

apparmor.d/groups/pacman/pacman-hook-depmod

@@ -15,5 +15,9 @@ profile pacman-hook-depmod @{exec_path} {
   /{usr/,}bin/bash   rix,
   /{usr/,}bin/depmod rPx,
 
+  # Inherit Silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
   include if exists <local/pacman-hook-depmod>
 }

apparmor.d/groups/pacman/pacman-hook-dkms

@@ -12,5 +12,11 @@ profile pacman-hook-dkms @{exec_path} {
 
   @{exec_path} mr,
 
+  /{usr/,}bin/kmod rPx,
+
+  # Inherit Silencer
+  deny network inet6 stream,
+  deny network inet stream,
+
   include if exists <local/pacman-hook-dkms>
 }

apparmor.d/groups/pacman/pacman-hook-gio

@@ -16,7 +16,14 @@ profile pacman-hook-gio @{exec_path} {
   /{usr/,}bin/rmdir            rix,
   /{usr/,}bin/gio-querymodules rPx,
 
-  /{usr/,}lib/gio/modules/{,**} rw,
+  /{usr/,}lib/gio/modules/giomodule.cache{,.[0-9A-Z]*} rw,
+  /{usr/,}lib/gtk-{3,4}.0/**/*/ rw,
+
+  /dev/tty rw,
+
+  # Inherit Silencer
+  deny network inet6 stream,
+  deny network inet stream,
 
   include if exists <local/pacman-hook-gio>
 }

apparmor.d/groups/pacman/pacman-hook-mkinitcpio-install

@@ -13,6 +13,8 @@ profile pacman-hook-mkinitcpio-install @{exec_path} {
   capability dac_read_search,
   capability mknod,
 
+  unix (receive) type=stream,
+
   @{exec_path} mr,
 
   /{usr/,}bin/bash       rix,
@@ -25,7 +27,9 @@ profile pacman-hook-mkinitcpio-install @{exec_path} {
   /usr/share/mkinitcpio/*.preset r,
 
   /etc/mkinitcpio.d/{,**} r,
+  /etc/mkinitcpio.d/*.preset rw,
 
+  / r,
   owner /boot/vmlinuz-* rw,
 
   /dev/tty rw,

apparmor.d/groups/pacman/pacman-hook-perl

@@ -10,6 +10,9 @@ include <tunables/global>
 profile pacman-hook-perl @{exec_path} {
   include <abstractions/base>
 
+  capability dac_read_search,
+  capability mknod,
+
   @{exec_path} mr,
 
   /{usr/,}bin/perl    rix,

apparmor.d/groups/pacman/pacman-hook-systemd

@@ -17,15 +17,15 @@ profile pacman-hook-systemd @{exec_path} {
   /{usr/,}bin/bash  rix,
   /{usr/,}bin/touch rix,
 
-  /{usr/,}bin/journalctl           rPx,
+  /{usr/,}bin/journalctl             rPx,
-  /{usr/,}bin/systemctl            rPx -> child-systemctl,
+  /{usr/,}bin/systemctl              rPx -> child-systemctl,
-  /{usr/,}bin/systemd-binfmt       rPx,
+  /{usr/,}bin/systemd-binfmt         rPx,
-  /{usr/,}bin/systemd-detect-virt  rPx,
+  /{usr/,}bin/systemd-detect-virt    rPx,
-  /{usr/,}bin/systemd-hwdb         rPx,
+  /{usr/,}bin/systemd-hwdb           rPx,
-  /{usr/,}bin/systemd-sysctl       rPx,
+  /{usr/,}bin/systemd-sysusers       rPx,
-  /{usr/,}bin/systemd-sysusers     rPx,
+  /{usr/,}bin/systemd-tmpfiles       rPx,
-  /{usr/,}bin/systemd-tmpfiles     rPx,
+  /{usr/,}bin/udevadm                rPx,
-  /{usr/,}bin/udevadm              rPx,
+  /{usr/,}lib/systemd/systemd-sysctl rPx,
 
   /usr/ rw,
 

apparmor.d/groups/systemd/systemd-ask-password

@@ -0,0 +1,20 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/systemd-ask-password
+profile systemd-ask-password @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+
+  @{exec_path} mr,
+
+        @{PROC}/filesystems r,
+  owner @{PROC}/@{pid}/stat r,
+
+  include if exists <local/systemd-ask-password>
+}

apparmor.d/profiles-a-l/browserpass

@@ -23,6 +23,7 @@ profile browserpass @{exec_path} flags=(attach_disconnected) {
   owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.default/startupCache/scriptCache-*.bin r,
   owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.default/startupCache/startupCache.*.little r,
   owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.default/safebrowsing-updating/google[0-9]/goog-phish-proto-[0-9]*.vlpset rw,
+  owner /tmp/mozilla-temp-[0-9]* r,
 
   @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
 

apparmor.d/profiles-a-l/gio-querymodules

@@ -14,6 +14,7 @@ profile gio-querymodules @{exec_path} {
   @{exec_path} mr,
 
   /{usr/,}lib/gtk-{3,4}.0/**/giomodule.cache{,.[0-9A-Z]*} w,
+  /{usr/,}lib/gio/modules/giomodule.cache{,.[0-9A-Z]*} w,
 
   include if exists <local/gio-querymodules>
 }

apparmor.d/profiles-a-l/kmod

@@ -24,6 +24,9 @@ profile kmod @{exec_path} {
   # than to standard error.
   capability syslog,
 
+  # Needed for static-nodes
+  capability dac_override,
+
   unix (receive) type=stream,
 
   @{exec_path} mr,
@@ -45,8 +48,6 @@ profile kmod @{exec_path} {
   # Initframs
   owner /tmp/mkinitcpio.*/{,**} rw,
 
-  # Needed for static-nodes
-  #capability dac_override,
   #owner @{PROC}/@{pid}/fd/1 w,
 
   # For local kernel build

apparmor.d/profiles-m-z/run-parts

@@ -25,6 +25,7 @@ profile run-parts @{exec_path} {
   /etc/kernel/postinst.d/apt-auto-removal rCx -> kernel-pre-post,
   /etc/kernel/postinst.d/dkms             rCx -> kernel-pre-post,
   /etc/kernel/postinst.d/initramfs-tools  rCx -> kernel-pre-post,
+  /etc/kernel/postinst.d/unattended-upgrades rCx -> kernel-pre-post,
   /etc/kernel/postinst.d/zz-update-grub   rCx -> kernel-pre-post,
 
   /etc/kernel/postrm.d/ r,

apparmor.d/profiles-m-z/update-initramfs

@@ -19,13 +19,14 @@ profile update-initramfs @{exec_path} {
 
   /{usr/,}sbin/             r,
 
+  /{usr/,}bin/cat           rix,
+  /{usr/,}bin/gawk          rix,
   /{usr/,}bin/getopt        rix,
   /{usr/,}bin/ischroot      rix,
-  /{usr/,}bin/gawk          rix,
   /{usr/,}bin/ln            rix,
+  /{usr/,}bin/mawk          rix,
   /{usr/,}bin/mv            rix,
   /{usr/,}bin/rm            rix,
-  /{usr/,}bin/cat           rix,
   /{usr/,}bin/sha1sum       rix,
   /{usr/,}bin/sync          rix,
   /{usr/,}bin/uname         rix,