feat(profile): general update.

apparmor.d/abstractions/app/sudo

@@ -41,6 +41,7 @@
   / r,
   /etc/machine-id r,
 
+        /var/db/sudo/lectured/ r,
   owner /var/lib/sudo/ts/ rw,   
   owner /var/lib/sudo/ts/@{uid} rwk,
   owner /var/log/sudo.log wk,

apparmor.d/abstractions/common/systemd

@@ -3,7 +3,7 @@
 # Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
-  ptrace (read) peer=@{p_systemd},
+  ptrace read peer=@{p_systemd},
 
   @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
   @{sys}/fs/cgroup/system.slice/@{profile_name}.service/memory.pressure rw,

apparmor.d/abstractions/gnome-strict

@@ -13,6 +13,8 @@
        member=Introspect 
        peer=(name=:*, label=gnome-shell),
 
+  /usr/share/icu/@{int}.@{int}/*.dat r,
+
   /usr/{local/,}share/ r,
   /usr/{local/,}share/glib-@{int}.@{int}/schemas/** r,
   /usr/{local/,}share/gvfs/remote-volume-monitors/{,*}  r,

apparmor.d/groups/_full/default

@@ -70,11 +70,8 @@ profile default @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   @{MOUNTS}/** rwl,
   owner @{HOME}/{,**} rwlk,
   owner @{run}/user/@{uid}/{,**} rw,
-  owner @{user_config_dirs}/** rwkl,
-  owner @{user_share_dirs}/** rwkl,
   owner @{tmp}/{,**} rwk,
-
+  owner @{run}/user/@{uid}/{,**} rwlk,
-  owner @{run}/user/@{uid}/{,**} rw,
 
   @{run}/motd.dynamic.new rw,
 

apparmor.d/groups/browsers/firefox-crashreporter

@@ -30,6 +30,9 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
+  @{bin}/curl rix,
+  @{bin}/mv   rix,
+
   @{lib_dirs}/minidump-analyzer rPx,
 
   @{bin}/mv rix,

apparmor.d/groups/children/child-modprobe-nvidia

@@ -71,7 +71,7 @@ profile child-modprobe-nvidia flags=(attach_disconnected) {
     # @{sys}/module/{drm,nvidia}/initstate r,
     @{sys}/module/compression r,
 
-    deny  @{HOME}/.steam/** r,
+    deny @{HOME}/.steam/** r,
 
     include if exists <local/child-modprobe-nvidia_kmod>
   }

apparmor.d/groups/gnome/gdm-session-worker

@@ -29,6 +29,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
   capability sys_tty_config,
 
   network netlink raw,
+  network unix stream,
 
   signal (receive) set=term peer=gdm,
   signal (send) set=(hup term) peer=gdm-session,

apparmor.d/groups/gnome/gsd-media-keys

@@ -27,6 +27,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
 
   signal (receive) set=(term, hup) peer=gdm*,
 
+  network inet stream,
   network netlink raw,
 
   #aa:dbus own bus=session name=org.gnome.SettingsDaemon.MediaKeys

apparmor.d/groups/gnome/session-migration

@@ -21,6 +21,8 @@ profile session-migration @{exec_path} {
   owner @{gdm_share_dirs}/session_migration-* rw,
   owner @{user_share_dirs}/session_migration-* rw,
 
+  /dev/tty@{int} rw,
+
   include if exists <local/session-migration>
 }
 

apparmor.d/groups/pacman/aurpublish

@@ -29,7 +29,7 @@ profile aurpublish @{exec_path} {
   @{bin}/date        rix,
   @{bin}/gettext     rix,
   @{bin}/git         rPx,
-  @{bin}/gpg{,2}     rPx,
+  @{bin}/gpg{,2}     rCx -> gpg,
   @{bin}/grep        rix,
   @{bin}/makepkg     rix,
   @{bin}/mkdir       rix,
@@ -48,10 +48,9 @@ profile aurpublish @{exec_path} {
   /etc/makepkg.conf.d/{,**} r,
 
   owner @{user_build_dirs}/**/ w,
-  owner @{user_projects_dirs}/**/ r,
+  owner @{user_projects_dirs}/** r,
   owner @{user_projects_dirs}/**/.git/COMMIT_EDITMSG rw,
   owner @{user_projects_dirs}/**/.SRCINFO rw,
-  owner @{user_projects_dirs}/**/PKGBUILD r,
 
   owner @{user_cache_dirs}/makepkg/src/* rw,
   owner @{user_config_dirs}/pacman/makepkg.conf r,
@@ -62,6 +61,22 @@ profile aurpublish @{exec_path} {
 
   /dev/tty rw,
 
+  profile gpg {
+    include <abstractions/base>
+
+    @{bin}/gpg{,2} mr,
+    @{bin}/gpgconf mr,
+
+    owner @{HOME}/@{XDG_GPG_DIR}/ rw,
+    owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
+
+    owner @{user_cache_dirs}/makepkg/src/*.asc r,
+
+    owner @{tmp}/tmp.@{rand10} rw,
+
+    include if exists <local/aurpublish_gpg>
+  }
+
   include if exists <local/aurpublish>
 }
 

apparmor.d/groups/systemd/systemd-cryptsetup

@@ -12,6 +12,7 @@ profile systemd-cryptsetup @{exec_path} {
   include <abstractions/common/systemd>
   include <abstractions/disks-write>
 
+  capability dac_read_search,
   capability ipc_lock,
   capability net_admin,
   capability sys_admin,

apparmor.d/groups/systemd/systemd-logind

@@ -63,6 +63,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) {
   /var/lib/systemd/linger/ r,
 
   @{run}/.#nologin* rw,
+  @{run}/credentials/getty@tty@{int}.service/ r,
   @{run}/host/container-manager r,
   @{run}/nologin rw,
   @{run}/utmp rk,

apparmor.d/groups/systemd/systemd-udevd

@@ -52,6 +52,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
   @{bin}/more             rPx -> child-pager,
   @{bin}/multipath        rPx,
   @{bin}/nfsrahead        rix,
+  @{bin}/nvidia-modprobe  rPx -> child-modprobe-nvidia,
   @{bin}/pager            rPx -> child-pager,
   @{bin}/perl             rix,
   @{bin}/setfacl          rix,

apparmor.d/groups/ubuntu/apport-gtk

@@ -51,6 +51,7 @@ profile apport-gtk @{exec_path} {
   @{bin}/pkexec                 rPx, # TODO: rCx or something
   @{bin}/systemctl              rCx -> systemctl,
   @{bin}/systemd-detect-virt    rPx,
+  @{bin}/uname                  rix,
   @{bin}/which{,.debianutils}   rix,
   @{lib}/{,colord/}colord-sane  rPx,
   @{lib}/@{multiarch}/ld*.so*   rix,
@@ -60,8 +61,8 @@ profile apport-gtk @{exec_path} {
   /usr/share/apport/general-hooks/*.py r,
 
   /etc/apport/{,**} r,
-  /etc/cloud/cloud.cfg.d/{,**} r,
   /etc/bash_completion.d/apport_completion r,
+  /etc/cloud/{,**} r,
   /etc/cron.daily/apport r,
   /etc/default/apport r,
   /etc/gtk-3.0/settings.ini r,
@@ -69,13 +70,15 @@ profile apport-gtk @{exec_path} {
   /etc/logrotate.d/apport r,
   /etc/xdg/autostart/*.desktop r,
 
-  /var/crash/{,*.@{uid}.crash} rw,
   /var/lib/dpkg/info/ r,
   /var/lib/dpkg/info/*.list r,
   /var/lib/usbutils/*.ids r,
   /var/lib/dpkg/info/*.md5sums r,
   /var/log/installer/media-info r,
 
+        /var/crash/ rw,
+  owner /var/crash/*.@{uid}.{crash,upload} rw,
+
    @{run}/snapd.socket rw,
 
   /tmp/[a-z0-9]* rw,
@@ -104,6 +107,7 @@ profile apport-gtk @{exec_path} {
     @{bin}/* r,
 
     /usr/share/gcc/python/{,**/}__pycache__/{,**} rw,
+    /usr/share/gdb/python/{,**/}__pycache__/{,**} rw,
 
     /usr/share/gdb/{,**} r,
     /usr/share/glib-2.0/schemas/gschemas.compiled r,

apparmor.d/profiles-a-f/agetty

@@ -34,6 +34,7 @@ profile agetty @{exec_path} {
   /etc/os-release r,
   /usr/etc/login.defs r,
 
+        @{run}/credentials/getty@tty@{int}.service/ r,
         @{run}/credentials/serial-getty@ttyS@{int}.service/ r,
   owner @{run}/agetty.reload rw,
 

apparmor.d/profiles-a-f/dino-im

@@ -11,10 +11,8 @@ include <tunables/global>
 profile dino-im @{exec_path} {
   include <abstractions/base>
   include <abstractions/dconf-write>
+  include <abstractions/desktop>
   include <abstractions/fontconfig-cache-read>
-  include <abstractions/fonts>
-  include <abstractions/freedesktop.org>
-  include <abstractions/gtk>
   include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
 
@@ -46,6 +44,7 @@ profile dino-im @{exec_path} {
     owner @{HOME}/.gnupg/ rw,
     owner @{HOME}/.gnupg/** rwkl -> @{HOME}/.gnupg/**,
 
+    include if exists <local/dino-im_gpg>
   }
 
   include if exists <local/dino-im>

apparmor.d/profiles-a-f/dkms

@@ -104,7 +104,7 @@ profile dkms @{exec_path} flags=(attach_disconnected) {
 
     owner /boot/System.map-* r,
 
-    audit owner @{tmp}/tmp.* r,
+    owner @{tmp}/tmp.@{rand10} r,
 
     @{sys}/module/compression r,
 

apparmor.d/profiles-a-f/fractal

@@ -23,6 +23,8 @@ profile fractal @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
+  /usr/share/xml/iso-codes/{,**} r,
+
   owner @{tmp}/.@{rand6} rw, 
   owner @{tmp}/.goutputstream-@{rand6} rw,
   owner @{tmp}/@{rand6} rw,

apparmor.d/profiles-a-f/fwupd

@@ -142,7 +142,8 @@ profile fwupd @{exec_path} flags=(complain,attach_disconnected) {
     owner /var/lib/fwupd/gnupg/ rw,
     owner /var/lib/fwupd/gnupg/** rwkl -> /var/lib/fwupd/gnupg/**,
 
-    owner @{PROC}/@{pids}/fd/ r,
+    owner @{PROC}/@{pid}/fd/ r,
+    owner @{PROC}/@{pid}/task/@{tid}/comm rw,
 
     include if exists <local/fwupd_gpg>
   }

apparmor.d/profiles-g-l/issue-generator

@@ -26,6 +26,8 @@ profile issue-generator @{exec_path} {
   @{run}/issue.@{rand10} rw,
   @{run}/issue.d/{,**} r,
 
+  /dev/tty rw,
+
   include if exists <local/issue-generator>
 }
 

apparmor.d/profiles-g-l/keepassxc

@@ -74,6 +74,7 @@ profile keepassxc @{exec_path} {
   owner @{tmp}/keepassxc-*.socket rw,
   owner @{tmp}/keepassxc.lock rw,
   owner @{tmp}/keepassxc.socket rw,
+  owner @{tmp}/runtime-user/ w,
 
   owner @{run}/user/@{pid}/app/ w,
   owner @{run}/user/@{pid}/app/org.keepassxc.KeePassXC/{,**} rw,

apparmor.d/profiles-s-z/snapd

@@ -40,6 +40,7 @@ profile snapd @{exec_path} {
   network inet dgram,
   network inet6 dgram,
   network netlink raw,
+  network unix stream,
 
   mount fstype=squashfs /dev/loop@{int} -> /tmp/syscheck-mountpoint-@{int}/,
   umount /tmp/syscheck-mountpoint-@{int}/,

apparmor.d/profiles-s-z/spice-vdagent

@@ -41,6 +41,9 @@ profile spice-vdagent @{exec_path} flags=(attach_disconnected) {
 
   @{run}/spice-vdagentd/spice-vdagent-sock rw,
 
+  @{sys}/devices/virtual/dmi/id/product_name r,
+  @{sys}/devices/virtual/dmi/id/sys_vendor r,
+
   owner @{PROC}/@{pids}/task/@{tid}/comm rw,
 
   owner /dev/tty@{int} rw,

apparmor.d/profiles-s-z/steam-gameoverlayui

@@ -18,6 +18,7 @@ profile steam-gameoverlayui @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/audio-client>
   include <abstractions/desktop>
+  include <abstractions/fontconfig-cache-write>
   include <abstractions/graphics>
 
   network inet stream,

apparmor.d/profiles-s-z/sudo

@@ -35,6 +35,8 @@ profile sudo @{exec_path} flags=(attach_disconnected) {
   /opt/*/**                         PUx,
   /snap/snapd/@{int}@{bin}/snap    rPUx,
 
+  /etc/default/locale r,
+
         /var/db/sudo/lectured/ r,
   owner /var/db/sudo/lectured/@{uid} rw,
   owner /var/lib/extrausers/shadow r,

apparmor.d/profiles-s-z/update-ca-trust

@@ -26,7 +26,7 @@ profile update-ca-trust @{exec_path} {
 
   /etc/ca-certificates/extracted/** rw,
   /etc/ssl/certs/{,*} rw,
-  /etc/ssl/certs/java/cacerts{,.*} w,
+  /etc/ssl/certs/java/** rw,
 
   /dev/tty rw,
 

apparmor.d/profiles-s-z/waybar

@@ -7,7 +7,6 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = @{bin}/waybar
-
 profile waybar @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/audio>