Update profile from #25 (2).

apparmor.d/groups/bus/dbus-daemon

@@ -68,6 +68,10 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
   /var/lib/gdm/.local/share/icc/ r,
   /var/lib/gdm/.local/share/icc/edid-*.icc r,
 
+  # Extra rules for Flatpak
+  /var/lib/flatpak/exports/share/dbus-1/{,**} r,
+  /var/lib/flatpak/app/**/export/share/dbus-1/services/{,**} r,
+
   /dev/dri/card[0-9]* rw,
   /dev/input/event[0-9]* rw,
 

apparmor.d/groups/desktop/at-spi-bus-launcher

@@ -26,7 +26,8 @@ profile at-spi-bus-launcher @{exec_path} {
 
   @{exec_path} mr,
 
-  /{usr/,}bin/dbus-daemon rPx,
+  /{usr/,}bin/dbus-daemon         rPx,
+  /{usr/,}bin/dbus-broker-launch rPUx,
 
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/cgroup r,

apparmor.d/groups/desktop/colord

@@ -18,17 +18,25 @@ profile colord @{exec_path} flags=(attach_disconnected) {
   @{exec_path} mr,
 
   /{usr/,}lib/colord/colord-sane  rPx,
-  @{libexec}/colord-sane  rPx,
+  @{libexec}/colord-sane          rPx,
+
+  /etc/machine-id r,
+  /etc/udev/hwdb.bin r,
+
+  /usr/share/mime/mime.cache r,
+  /usr/share/color/icc/{,**} r,
 
   owner /var/lib/colord/** r,
   owner /var/lib/colord/.cache/ rw,
   owner /var/lib/colord/.cache/** rw,
   owner /var/lib/colord/{mapping,storage}.db{,-journal} rwk,
+
+  /var/lib/flatpak/exports/share/mime/mime.cache r,
   /var/lib/gdm/.local/share/icc/edid-*.icc r,
 
-  /etc/udev/hwdb.bin r,
+  @{user_share_dirs}/icc/edid-*.icc r,
 
-  /usr/share/color/icc/{,**} r,
+  @{run}/systemd/sessions/[0-9]* r,
 
   @{sys}/class/drm/ r,
   @{sys}/class/video4linux/ r,
@@ -39,11 +47,5 @@ profile colord @{exec_path} flags=(attach_disconnected) {
         @{PROC}/@{pids}/cgroup r,
         @{PROC}/@{pids}/cmdline r,
 
-  /usr/share/mime/mime.cache r,
-
-  @{user_share_dirs}/icc/edid-*.icc r,
-
-  @{run}/systemd/sessions/[0-9]* r,
-
   include if exists <local/colord>
 }

apparmor.d/groups/gnome/gdm

@@ -24,7 +24,8 @@ profile gdm @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
-  /{usr/,}lib/gdm-session-worker rPx,
+  /{usr/,}bin/plymouth            rPUx,
+  /{usr/,}lib/gdm-session-worker  rPx,
 
   /usr/share/gdm/gdm.schemas r,
   /usr/share/wayland-sessions/*.desktop r,

apparmor.d/groups/gnome/gdm-session-worker

@@ -22,6 +22,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
   capability setgid,
   capability setuid,
   capability sys_nice,
+  capability sys_resource,
   capability sys_tty_config,
 
   signal (receive) set=term peer=gdm,

apparmor.d/groups/gnome/gdm-wayland-session

@@ -33,8 +33,9 @@ profile gdm-wayland-session @{exec_path} {
   /{usr/,}bin/flatpak             rPUx,
   /{usr/,}lib/gnome-session-binary rPx,
 
-  /etc/shells r,
   /etc/gdm/custom.conf r,
+  /etc/machine-id r,
+  /etc/shells r,
 
   /usr/share/gdm/gdm.schemas r,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,

apparmor.d/groups/gnome/gnome-control-center-print-renderer

@@ -25,6 +25,9 @@ profile gnome-control-center-print-renderer @{exec_path} {
   /usr/share/pixmaps/{,**} r,
   /usr/share/X11/xkb/** r,
 
+  /var/lib/flatpak/exports/share/icons/{,**} r,
+  /var/lib/flatpak/exports/share/mime/mime.cache r,
+
   owner @{user_cache_dirs}/mesa_shader_cache/index rw,
   owner @{user_share_dirs}/icons/{,**} r,
 

apparmor.d/groups/gnome/gnome-session-binary

@@ -34,15 +34,15 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
 
   /{usr/,}bin/aa-notify                                    rPx,
   /{usr/,}bin/blueman-applet                               rPx,
+  /{usr/,}bin/firewall-applet                             rPUx,
   /{usr/,}bin/gnome-keyring-daemon                         rPx,
   /{usr/,}bin/gnome-shell                                  rPx,
+  /{usr/,}bin/pkcs11-register                              rPx,
+  /{usr/,}bin/start-pulseaudio-x11                         rPx,
   /{usr/,}bin/xbrlapi                                      rPx,
   /{usr/,}lib/evolution-data-server/evolution-alarm-notify rPx,
   /{usr/,}lib/gsd-*                                        rPx,
 
-  /{usr/,}bin/pkcs11-register                              rPx,
-  /{usr/,}bin/start-pulseaudio-x11                         rPx,
-
   /usr/share/applications/org.gnome.Shell.desktop r,
   /usr/share/gdm/greeter-dconf-defaults r,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,

apparmor.d/groups/gnome/gnome-shell

@@ -68,7 +68,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   /var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-{,wayland-}[0-9] r,
   /var/lib/gdm/.config/pulse/ r,
   /var/lib/gdm/.config/pulse/client.conf r,
-  /var/lib/gdm/.config/pulse/cookie rw,
+  /var/lib/gdm/.config/pulse/cookie rwk,
   /var/lib/gdm/.local/share/applications/{,**} r,
   /var/lib/gdm/.local/share/gnome-shell/ rw,
 
@@ -106,6 +106,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   owner @{run}/user/@{uid}/gdm/Xauthority r,
   owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* rw,
 
+  /var/lib/flatpak/app/**/gnome-shell/{,**} r,
+  /var/lib/flatpak/exports/share/gnome-shell/{,**} r,
+
   @{run}/systemd/users/@{uid} r,
   @{run}/systemd/seats/seat[0-9]* r,
   @{run}/systemd/sessions/ r,

apparmor.d/groups/gnome/gnome-system-monitor

@@ -30,6 +30,8 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
   /usr/share/gnome-system-monitor/{,**} r,
   /usr/share/pixmaps/{,**} r,
 
+  /etc/machine-id r,
+
   owner @{user_share_dirs}/gvfs-metadata/{,*} r,
 
   include <abstractions/dconf>

apparmor.d/groups/gnome/gsd-color

@@ -25,6 +25,7 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
 
   /var/lib/gdm/.local/share/icc/ rw,
   /var/lib/gdm/.local/share/icc/edid-*.icc rw,
+  /var/lib/flatpak/exports/share/mime/mime.cache r,
 
   owner @{run}/user/@{uid}/gdm/Xauthority r,
 

apparmor.d/groups/gnome/gsd-print-notifications

@@ -20,6 +20,8 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) {
   @{exec_path} mr,
   /{usr/,}lib/gsd-printer rPx,
 
+  /etc/machine-id r,
+
   owner @{PROC}/@{pid}/fd/ r,
 
   owner /dev/tty[0-9]* rw,

apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor

@@ -35,6 +35,7 @@ profile gvfs-udisks2-volume-monitor @{exec_path} {
   @{run}/systemd/sessions/[0-9]* r,
 
   /etc/fstab r,
+  /etc/machine-id r,
 
   # Mount points
   @{MOUNTS}/*/ r,

apparmor.d/groups/gvfs/gvfsd-fuse

@@ -37,6 +37,7 @@ profile gvfsd-fuse @{exec_path} {
     umount @{run}/user/@{uid}/**/,
 
     /etc/fuse.conf r,
+    /etc/machine-id r,
 
     /dev/fuse rw,
 

apparmor.d/groups/network/NetworkManager

@@ -10,8 +10,8 @@ include <tunables/global>
 profile NetworkManager @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
-  include <abstractions/ssl_certs>
   include <abstractions/openssl>
+  include <abstractions/ssl_certs>
 
   network inet stream,
   network inet6 stream,
@@ -35,17 +35,18 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
-  /{usr/,}lib/nm-dhcp-helper rPx,
-  /{usr/,}lib/nm-dispatcher rPx,
-  /{usr/,}lib/nm-iface-helper rPx,
-  /{usr/,}lib/nm-initrd-generator rPx,
-  /{usr/,}lib/nm-openvpn-auth-dialog rPx,
-  /{usr/,}lib/nm-openvpn-service rPx,
-  /{usr/,}lib/nm-openvpn-service-openvpn-helper rPx,
- 
-  /{usr/,}bin/systemctl rPx -> child-systemctl,
   /{usr/,}bin/{,ba,da}sh rix,
 
+  /{usr/,}bin/resolvconf                         rPx,
+  /{usr/,}bin/systemctl                          rPx -> child-systemctl,
+  /{usr/,}lib/nm-dhcp-helper                     rPx,
+  /{usr/,}lib/nm-dispatcher                      rPx,
+  /{usr/,}lib/nm-iface-helper                    rPx,
+  /{usr/,}lib/nm-initrd-generator                rPx,
+  /{usr/,}lib/nm-openvpn-auth-dialog             rPx,
+  /{usr/,}lib/nm-openvpn-service                 rPx,
+  /{usr/,}lib/nm-openvpn-service-openvpn-helper  rPx,
+
   /dev/rfkill rw,
 
   / r,

apparmor.d/groups/systemd/bootctl

@@ -34,8 +34,10 @@ profile bootctl @{exec_path} {
 
    /etc/machine-id r,
 
+  @{sys}/devices/virtual/dmi/id/{board_vendor,bios_vendor} r,
   @{sys}/devices/virtual/dmi/id/{sys_vendor,product_version,product_name} r,
 
+  @{sys}/firmware/dmi/entries/*/raw r,
   @{sys}/firmware/efi/efivars/ r,
   @{sys}/firmware/efi/efivars/Boot[0-9A-F]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r,
   @{sys}/firmware/efi/efivars/BootOrder-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r,

apparmor.d/groups/systemd/systemd-coredump

@@ -32,6 +32,7 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected) {
 
   /var/lib/systemd/coredump/ r,
   /var/lib/systemd/coredump/** rwl,
+  /var/lib/systemd/coredump/#[0-9]* rwl,
 
   owner @{PROC}/@{pid}/setgroups r,
         @{PROC}/@{pids}/comm r,

apparmor.d/groups/systemd/systemd-makefs

@@ -16,6 +16,7 @@ profile systemd-makefs @{exec_path} {
   @{exec_path} mr,
 
   /{usr/,}{s,}bin/mkswap     rPx,
+  /{usr/,}bin/mkfs.*         rPx,
 
   @{sys}/devices/virtual/block/zram[0-9]*/ r,
   @{sys}/devices/virtual/block/zram[0-9]*/** r,

apparmor.d/groups/systemd/systemd-oomd

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = /{usr/,}lib/systemd/systemd-oomd
 profile systemd-oomd @{exec_path} {
   include <abstractions/base>
+  include <abstractions/systemd-common>
 
   capability dac_override,
   capability kill,
@@ -17,11 +18,9 @@ profile systemd-oomd @{exec_path} {
 
   /etc/systemd/oomd.conf r,
 
-  @{PROC}/1/cgroup r,
+  @{sys}/fs/cgroup/cgroup.controllers r,
-  @{PROC}/cmdline r,
+
   @{PROC}/pressure/{cpu,io,memory} r,
-  @{PROC}/sys/kernel/osrelease r,
-  @{PROC}/sys/kernel/random/boot_id r,
 
   include if exists <local/systemd-oomd>
 }

apparmor.d/groups/systemd/systemd-user-runtime-dir

@@ -24,6 +24,8 @@ profile systemd-user-runtime-dir @{exec_path} {
 
   @{exec_path} mr,
 
+  /etc/machine-id r,
+
   @{run}/user/@{uid}/{,**} rw,
 
   @{PROC}/1/environ r,

apparmor.d/groups/systemd/zram-generator

@@ -18,12 +18,15 @@ profile zram-generator @{exec_path} {
 
   /etc/systemd/zram-generator.conf r,
 
-  @{sys}/devices/virtual/block/zram[0-9]*/{disksize,reset} rw,
+  @{sys}/devices/virtual/block/zram[0-9]*/{disksize,reset,comp_algorithm} rw,
   @{sys}/block/zram[0-9]*/{disksize,reset} rw,
 
-  owner @{run}/systemd/generator/systemd-zram-setup@zram[0-9]*.service.d/{,*.conf} rw,
+  owner @{run}/systemd/generator/{,*/}var-cache-makepkg.mount rw,
   owner @{run}/systemd/generator/dev-zram[0-9]*.swap rw,
   owner @{run}/systemd/generator/swap.target.wants/{,dev-zram[0-9]*.swap} rw,
+  owner @{run}/systemd/generator/systemd-zram-setup@zram[0-9]*.service.d/{,*.conf} rw,
+
+  @{PROC}/crypto r,
 
   include if exists <local/zram-generator>
 }

apparmor.d/profiles-a-f/apparmor_parser

@@ -18,6 +18,8 @@ profile apparmor_parser @{exec_path} flags=(attach_disconnected) {
   /etc/apparmor.d/{,**} r,
   /etc/apparmor.d/cache.d/{,**} rw,
 
+  /usr/share/apparmor/{,**} r,
+
   owner /var/cache/apparmor/{,**} rw,
   owner /var/lib/docker/tmp/docker-default[0-9]* r,
 

apparmor.d/profiles-a-f/firecfg

@@ -32,7 +32,7 @@ profile firecfg @{exec_path} flags=(attach_disconnected) {
   /usr/share/applications/*.desktop r,
 
   @{user_share_dirs}/applications/ r,
-  @{user_share_dirs}/applications/*.desktop r,
+  @{user_share_dirs}/applications/*.desktop rw,
 
   /dev/tty rw,
 

apparmor.d/profiles-a-f/fusermount

@@ -41,6 +41,7 @@ profile fusermount @{exec_path} {
   umount @{run}/user/@{uid}/gvfs/,
 
   /etc/fuse.conf r,
+  /etc/machine-id r,
 
   /dev/fuse rw,
 

apparmor.d/profiles-g-l/id

@@ -14,5 +14,7 @@ profile id @{exec_path} {
 
   @{exec_path} mr,
 
+  /etc/machine-id r,
+
   include if exists <local/id>
 }

apparmor.d/profiles-g-l/kmod

@@ -29,7 +29,10 @@ profile kmod @{exec_path} flags=(attach_disconnected) {
 
   unix (receive) type=stream,
 
-  @{exec_path} mr,
+  @{exec_path} mrix,
+
+  /{usr/,}bin/{,ba,da}sh  rix,
+  /{usr/,}bin/sysctl      rPx,
 
   /{usr/,}lib/modprobe.d/{,*.conf} r,
   /etc/modprobe.d/{,*.conf} r,

apparmor.d/profiles-m-r/pipewire

@@ -19,8 +19,9 @@ profile pipewire @{exec_path} {
 
   /usr/share/pipewire/pipewire.conf r,
 
-  /etc/pipewire/pipewire.conf r,
+  /etc/machine-id r,
   /etc/pipewire/client.conf r,
+  /etc/pipewire/pipewire.conf r,
 
   owner @{run}/user/@{uid}/pipewire-[0-9]*.lock rwk,
 

apparmor.d/profiles-m-r/pipewire-pulse

@@ -18,6 +18,8 @@ profile pipewire-pulse @{exec_path} {
 
   @{exec_path} mr,
 
+  /etc/machine-id r,
+
   /etc/pipewire/client.conf r,
   /etc/pipewire/pipewire-pulse.conf r,
   /usr/share/pipewire/client.conf r,

apparmor.d/profiles-m-r/polkitd

@@ -29,6 +29,8 @@ profile polkitd @{exec_path} {
   @{PROC}/1/environ r,
   @{PROC}/cmdline r,
 
+  /etc/machine-id r,
+
   # System rules
   /etc/polkit-1/rules.d/ r,
   /etc/polkit-1/rules.d/[0-9][0-9]-*.rules r,

apparmor.d/profiles-m-r/power-profiles-daemon

@@ -24,7 +24,7 @@ profile power-profiles-daemon @{exec_path} {
   @{sys}/class/ r,
   @{sys}/class/power_supply/ r,
   @{sys}/devices/**/power_supply/*/uevent r,
-  @{sys}/devices/system/cpu/*_pstate/no_turbo r,
+  @{sys}/devices/system/cpu/*_pstate/{no_turbo,turbo_pct} r,
   @{sys}/devices/system/cpu/cpufreq/ r,
   @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/energy_performance_preference rw,
 

apparmor.d/profiles-m-r/resolvconf

@@ -9,17 +9,22 @@ include <tunables/global>
 @{exec_path} = /{usr/,}sbin/resolvconf
 profile resolvconf @{exec_path} {
   include <abstractions/base>
+  include <abstractions/nameservice-strict>
 
   @{exec_path} mr,
 
   /{usr/,}bin/{,ba,da}sh  rix,
   /{usr/,}bin/cat         rix,
   /{usr/,}bin/flock       rix,
+  /{usr/,}bin/mkdir       rix,
   /{usr/,}bin/mv          rix,
   /{usr/,}bin/rm          rix,
   /{usr/,}bin/run-parts   rix,
   /{usr/,}bin/sed         rix,
 
+  /usr/lib/resolvconf/{,**} r,
+
+  /etc/resolv.conf rw,
   /etc/resolvconf/update.d/libc mr,
 
   owner @{run}/resolvconf/{,**} rw,

apparmor.d/profiles-s-z/wireplumber

@@ -20,10 +20,14 @@ profile wireplumber @{exec_path} {
 
   @{exec_path} mr,
 
+  /etc/machine-id r,
+
   /usr/share/alsa-card-profile/{,**} r,
   /usr/share/spa-*/bluez[0-9]*/{,*} r,
   /usr/share/wireplumber/{,**} r,
 
+  /var/lib/gdm/.local/state/wireplumber/{,**} r,
+
   owner @{HOME}/.local/state/ w,
   owner @{HOME}/.local/state/wireplumber/{,**} rw,
 

apparmor.d/profiles-s-z/xdg-dbus-proxy

@@ -16,6 +16,7 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected, complain) {
 
   owner @{run}/firejail/dbus/[0-9]*/[0-9]*-user rw,
   owner @{run}/user/@{uid}/webkitgtk/dbus-proxy-[0-9A-Z]* rw,
+  owner @{run}/user/@{uid}/.dbus-proxy/{session,a11y}-bus-proxy-[0-9A-Z]* rw,
 
   @{sys}/devices/virtual/thermal/thermal_zone[0-9]/hwmon[0-9]/temp* r,
 

apparmor.d/profiles-s-z/xdg-desktop-portal

@@ -11,18 +11,27 @@ profile xdg-desktop-portal @{exec_path} {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
 
+  capability sys_ptrace,
+
   network netlink raw,
 
   ptrace (read),
 
   @{exec_path} mr,
 
+  /{usr/,}lib/x r,
+
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /usr/share/mime/mime.cache r,
   /usr/share/pipewire/client.conf r,
   /usr/share/xdg-desktop-portal/portals/{,*.portal} r,
 
+  /etc/machine-id r,
+
+  /var/lib/flatpak/exports/share/mime/mime.cache r,
+
   owner @{user_config_dirs}/user-dirs.dirs r,
+  owner @{run}/user/@{uid}/.flatpak/*/* r,
 
   include <abstractions/dconf>
   owner @{run}/user/@{uid}/dconf/ rw,

apparmor.d/profiles-s-z/xdg-document-portal

@@ -14,6 +14,7 @@ profile xdg-document-portal @{exec_path} {
 
   /{usr/,}bin/fusermount rPx,
 
+  owner @{user_share_dirs}/flatpak/db/documents r,
   owner @{run}/user/@{uid}/doc/ rw,
 
   /dev/fuse rw,

apparmor.d/profiles-s-z/xdg-permission-store

@@ -16,6 +16,7 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) {
   @{exec_path} mr,
 
   @{HOME}/@{XDG_DATA_HOME}/flatpak/db/gnome rw,
+  @{user_share_dirs}/flatpak/db/background r,
 
   /dev/tty[0-9]* rw,
 

dists/flags/debian.flags

@@ -16,7 +16,6 @@ dpkg-trigger complain
 dpkg-vendor complain
 ifup complain
 macchanger complain
-resolvconf complain
 run-parts complain
 unattended-upgrade complain
 unattended-upgrade-shutdown attach_disconnected,complain

dists/flags/main.flags

@@ -102,6 +102,7 @@ pass complain
 pass-import complain
 pinentry-gtk-2 complain
 podman attach_disconnected,complain
+resolvconf complain
 run-parts complain
 runuser complain
 s3fs complain