update apparmor profiles

apparmor.d/groups/apps/signal-desktop

@@ -21,6 +21,7 @@ profile signal-desktop @{exec_path} {
   include <abstractions/audio>
   include <abstractions/mesa>
   include <abstractions/nameservice-strict>
+  include <abstractions/user-download-strict>
   include <abstractions/deny-root-dir-access>
 
   # Needed?
@@ -95,6 +96,8 @@ profile signal-desktop @{exec_path} {
   /var/lib/dbus/machine-id r,
   /etc/machine-id r,
 
+  /usr/share/glib-2.0/schemas/gschemas.compiled r,
+
   # No new privs
   /{usr/,}bin/xdg-settings rPUx,
 

apparmor.d/groups/apps/telegram-desktop

@@ -21,6 +21,7 @@ profile telegram-desktop @{exec_path} {
   include <abstractions/user-download-strict>
   include <abstractions/qt5-compose-cache-write>
   include <abstractions/qt5-settings-write>
+  include <abstractions/qt5-shader-cache>
   include <abstractions/mesa>
   include <abstractions/nameservice-strict>
   include <abstractions/enchant>

apparmor.d/groups/apt/apt-listchanges

@@ -61,6 +61,7 @@ profile apt-listchanges @{exec_path} {
   owner /tmp/apt-listchanges*/*/*/*/*/*/changelog.gz rw,
   owner /tmp/apt-listchanges*/*/*/*/*/*/changelog/changelog_to_file rw,
   owner /tmp/apt-listchanges*/*/*/*/*/*/changelog/simple_changelog rw,
+  owner /tmp/apt-listchanges*/*/*/*/*/*/*-local/debian/changelog rw,
 
   # The following is needed when apt-listchanges uses debcconf GUI frontends.
   include <abstractions/gtk>

apparmor.d/groups/bus/dbus-daemon

@@ -26,7 +26,7 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
   network bluetooth stream,
   network bluetooth seqpacket,
 
-  ptrace (read) peer=unconfined,
+  ptrace (read),
 
   @{exec_path} mr,
 

apparmor.d/groups/gvfs/gvfsd-smb

@@ -24,6 +24,8 @@ profile gvfsd-smb @{exec_path} {
   owner @{run}/user/@{uid}/dconf/ rw,
   owner @{run}/user/@{uid}/dconf/user rw,
 
+  owner @{run}/user/@{uid}/gvfsd/socket-[a-zA-z0-9]* rw,
+
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
   /etc/samba/smb.conf r,

apparmor.d/groups/gvfs/gvfsd-smb-browse

@@ -24,6 +24,8 @@ profile gvfsd-smb-browse @{exec_path} {
   owner @{run}/user/@{uid}/dconf/ rw,
   owner @{run}/user/@{uid}/dconf/user rw,
 
+  owner @{run}/user/@{uid}/gvfsd/socket-[a-zA-z0-9]* rw,
+
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
   /etc/samba/smb.conf r,

apparmor.d/groups/gvfs/gvfsd-trash

@@ -27,7 +27,7 @@ profile gvfsd-trash @{exec_path} {
   @{run}/mount/utab r,
 
   owner @{run}/user/@{uid}/gvfsd/ rw,
-  owner @{run}/user/@{uid}/gvfsd/socket-[a-zA-z0-9]* rw,
+  owner @{run}/user/@{uid}/gvfsd/socket-* rw,
 
   # Can restore all user files
   owner @{HOME}/{,**} rw,

apparmor.d/profiles-g-l/gajim

@@ -49,6 +49,9 @@ profile gajim @{exec_path} {
   /{usr/,}bin/gpgconf    rCx -> gpg,
   /{usr/,}bin/gpgsm      rCx -> gpg,
 
+  /{usr/,}bin/ccache                 rCx -> ccache,
+  /{usr/,}bin/{,@{multiarch}-}ld.bfd rCx -> ccache,
+
   # External apps
   /{usr/,}bin/xdg-settings    rPx,
   /{usr/,}lib/firefox/firefox rPx,
@@ -98,6 +101,27 @@ profile gajim @{exec_path} {
   deny /usr/share/gajim/** w,
 
 
+  profile ccache {
+    include <abstractions/base>
+    include <abstractions/consoles>
+
+    /{usr/,}bin/ccache mr,
+
+    /{usr/,}lib/llvm-[0-9]*/bin/clang      rix,
+    /{usr/,}bin/{,@{multiarch}-}gcc-[0-9]* rix,
+    /{usr/,}bin/{,@{multiarch}-}g++-[0-9]* rix,
+    /{usr/,}bin/{,@{multiarch}-}ld.bfd     rix,
+    /{usr/,}lib/gcc/@{multiarch}/[0-9]*/collect2 rix,
+
+    owner /tmp/cc* rw,
+    owner /tmp/tmp* rw,
+
+    /media/ccache/*/** rw,
+
+    /etc/debian_version r,
+
+  }
+
   profile gpg {
     include <abstractions/base>
 

apparmor.d/profiles-g-l/git

@@ -52,6 +52,14 @@ profile git @{exec_path} {
   /{usr/,}bin/cat         rix,
   /{usr/,}bin/dirname     rix,
 
+  owner @{BUILD_DIR}/*/.repo/repo/hooks/* rwix,
+  /{usr/,}bin/mv          rix,
+  /{usr/,}bin/whoami      rix,
+  /{usr/,}bin/hostname    rix,
+  /{usr/,}bin/rm          rix,
+  /{usr/,}bin/cat         rix,
+  /{usr/,}bin/date        rix,
+
   /{usr/,}bin/pager       rPx -> child-pager,
   /{usr/,}bin/less        rPx -> child-pager,
   /{usr/,}bin/more        rPx -> child-pager,
@@ -71,7 +79,7 @@ profile git @{exec_path} {
   /{usr/,}bin/vim             rCx -> editor,
   /{usr/,}bin/vim.*           rCx -> editor,
 
-  owner @{HOME}/.gitconfig rw,
+  owner @{HOME}/.gitconfig r,
   owner @{user_config_dirs}/git/{,*} rw,
 
   /usr/share/git-core/{,**} r,

apparmor.d/profiles-g-l/iw

@@ -20,6 +20,8 @@ profile iw @{exec_path} {
 
   @{exec_path} mr,
 
+  @{sys}/devices/pci[0-9]*/**/ieee80211/phy[0-9]*/index r,
+
   # file_inherit
   owner /dev/tty[0-9]* rw,
 

apparmor.d/profiles-m-r/nft

@@ -16,6 +16,8 @@ profile nft @{exec_path} {
 
   network netlink raw,
 
+  ptrace(read),
+
   @{exec_path} mr,
 
   owner /etc/iproute2/** r,

apparmor.d/profiles-m-r/polkitd

@@ -17,7 +17,7 @@ profile polkitd @{exec_path} {
   capability sys_ptrace,
   audit deny capability net_admin,
 
-  ptrace (read) peer=unconfined,
+  ptrace (read),
 
   @{exec_path} mr,
 

apparmor.d/profiles-m-r/repo

@@ -80,6 +80,7 @@ profile repo @{exec_path} {
 
     /{usr/,}bin/gpg mr,
 
+    owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
     owner @{HOME}/.repoconfig/gnupg/** rwkl -> @{HOME}/.repoconfig/gnupg/**,
 
     owner /tmp/.git_vtag_tmp* r,

apparmor.d/profiles-s-z/update-ca-certificates

@@ -10,6 +10,7 @@ include <tunables/global>
 profile update-ca-certificates @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
+  include <abstractions/openssl>
   include <abstractions/ssl_certs>
 
   @{exec_path} r,
@@ -37,7 +38,7 @@ profile update-ca-certificates @{exec_path} {
 
   /etc/ r,
   /etc/ca-certificates.conf r,
-  /etc/ssl/certs/ca-certificates.crt rw,
+  /etc/ssl/certs/ca-certificates.crt{,.new} rw,
   /etc/ssl/certs/*.pem rw,
   /etc/ssl/certs/[0-9a-f]*.[0-9] rw,
 

apparmor.d/profiles-s-z/usr.sbin.cupsd

@@ -72,6 +72,7 @@
   /etc/pnm2ppa.conf r,
   /etc/printcap rwl,
   /etc/ssl/** r,
+  /etc/letsencrypt/archive/** r,
   @{PROC}/net/ r,
   @{PROC}/net/* r,
   @{PROC}/sys/dev/parport/** r,

apparmor.d/profiles-s-z/wpa-action

@@ -0,0 +1,42 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}sbin/wpa_action
+profile wpa-action @{exec_path} {
+  include <abstractions/base>
+
+  capability net_admin,
+
+  network netlink raw,
+
+  @{exec_path} mr,
+
+  /{usr/,}sbin/wpa_cli   rPx,
+
+  /{usr/,}bin/{,ba,da}sh rix,
+  /{usr/,}bin/logger     rix,
+  /{usr/,}bin/ln         rix,
+  /{usr/,}sbin/ifup      rix,
+  /{usr/,}bin/rm         rix,
+  /{usr/,}bin/ip         rix,
+  /{usr/,}bin/{,e}grep   rix,
+  /{usr/,}bin/cat        rix,
+  /{usr/,}bin/date       rix,
+
+  /etc/wpa_supplicant/{,**} r,
+
+  owner @{run}/wpa_action.wlan[0-9]*.ifupdown rw,
+  owner @{run}/wpa_action.wlan[0-9]*.timestamp rw,
+  owner @{run}/network/ifstate.wlan[0-9]* rwk,
+  owner @{run}/sendsigs.omit.d/wpasupplicant.wpa_supplicant.wlan[0-9]*.pid rw,
+
+  /etc/network/interfaces r,
+  /etc/network/interfaces.d/{,*} r,
+
+  include if exists <local/wpa-action>
+}

apparmor.d/profiles-s-z/wpa-cli

@@ -0,0 +1,26 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}sbin/wpa_cli
+profile wpa-cli @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  /{usr/,}sbin/wpa_action rPx,
+
+  owner @{run}/wpa_supplicant/ r,
+  owner /tmp/wpa_ctrl_@{pid}-[0-9] rw,
+
+  # for interactive mode
+  /etc/inputrc r,
+  owner @{HOME}/.wpa_cli_history rw,
+  owner @{HOME}/.wpa_cli_history-[0-9]*.tmp rw,
+
+  include if exists <local/wpa-cli>
+}

apparmor.d/profiles-s-z/xorg

@@ -132,7 +132,7 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
   @{run}/udev/data/+input* r,          # for mouse, keyboard, touchpad
   @{run}/udev/data/+platform* r,       # for ?
   @{run}/udev/data/+drm:card[0-9]-* r, # for screen outputs
-  #@{run}/udev/data/+dmi* r,           # for ?
+  @{run}/udev/data/+dmi* r,            # for ?
   @{run}/udev/data/+acpi* r,           # for ?
   @{run}/udev/data/+hid* r,            # for HID-Compliant Keyboard
   @{run}/udev/data/+pci* r,            # for VGA compatible controller