feat(profile): general update.

apparmor.d/abstractions/app/firefox

@@ -101,7 +101,7 @@
   owner @{tmp}/Temp-@{uuid}/ rw,
   owner @{tmp}/Temp-@{uuid}/* rwk,
   owner @{tmp}/tmp-*.xpi rw,
-  owner @{tmp}/tmpaddon r,
+  owner @{tmp}/tmpaddon rw,
   owner @{tmp}/tmpaddon-@{int} r,
 
   owner /dev/shm/org.chromium.@{rand6} rw,

apparmor.d/abstractions/common/bwrap

@@ -44,8 +44,11 @@
   owner /tmp/newroot/ w,
   owner /tmp/oldroot/ w,
 
-               @{PROC}/sys/kernel/overflowgid r,
-               @{PROC}/sys/kernel/overflowuid r,
+        @{PROC}/sys/kernel/overflowgid r,
+        @{PROC}/sys/kernel/overflowuid r,
+        @{PROC}/sys/user/max_user_namespaces r,
+  owner @{PROC}/@{pid}/fd/ r,
+
         @{att}/@{PROC}/sys/user/max_user_namespaces rw,
   owner @{att}/@{PROC}/@{pid}/cgroup r,
   owner @{att}/@{PROC}/@{pid}/fd/ r,

apparmor.d/groups/bus/dbus-accessibility

@@ -28,6 +28,10 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) {
 
   #aa:dbus own bus=accessibility name=org.freedesktop.DBus
   #aa:dbus own bus=session name=org.a11y.{B,b}us
+  dbus receive bus=accessibility path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus
+       member=Hello
+       peer=(name=@{busname}),
 
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable

apparmor.d/groups/bus/dbus-session

@@ -31,6 +31,10 @@ profile dbus-session flags=(attach_disconnected) {
   signal (send)    set=(term hup kill) peer=xdg-*,
 
   #aa:dbus own bus=session name=org.freedesktop.DBus path=/{,org/freedesktop/{d,D}Bus}
+  dbus receive bus=session path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus
+       member=Hello
+       peer=(name=@{busname}),
 
   @{exec_path} mrix,
 

apparmor.d/groups/bus/dbus-system

@@ -36,6 +36,7 @@ profile dbus-system flags=(attach_disconnected) {
   #aa:dbus own bus=system name=org.freedesktop.DBus path=/{,org/freedesktop/DBus}
   dbus receive bus=system path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
+       member=Hello
        peer=(name=@{busname}),
 
   @{exec_path} mrix,

apparmor.d/groups/gnome/gnome-session

@@ -17,6 +17,7 @@ profile gnome-session @{exec_path} {
 
   @{shells_path}               rix,
   @{bin}/cat                   rix,
+  @{bin}/find                  rix,
   @{bin}/gettext               rix,
   @{bin}/gettext.sh              r,
   @{bin}/grep                  rix,
@@ -32,6 +33,7 @@ profile gnome-session @{exec_path} {
   @{bin}/tr                    rix,
   @{bin}/tty                   rix,
   @{bin}/uname                 rPx,
+  @{bin}/xargs                 rix,
 
   @{bin}/dpkg-query            rpx,
   @{bin}/flatpak               rCx -> flatpak,
@@ -57,6 +59,7 @@ profile gnome-session @{exec_path} {
   /etc/X11/Xsession.d/*im-config_launch r,
 
   owner @{PROC}/@{pid}/cmdline r,
+  owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/loginuid r,
 
   /dev/tty@{int} rw,

apparmor.d/groups/gnome/gnome-shell

@@ -198,10 +198,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   /usr/share/gdm/greeter-dconf-defaults r,
   /usr/share/gdm/greeter/applications/{,**} r,
   /usr/share/libgweather/Locations.xml r,
-  /usr/share/libinput*/ r,
-  /usr/share/libinput*/{,**/}@{int2}-*.quirks r,
-  /usr/share/libinput*/libinput/ r,
+  /usr/share/libinput*/{,**} r,
   /usr/share/libwacom/{,*.stylus,*.tablet} r,
+  /usr/share/poppler/{,**} r,
   /usr/share/wallpapers/** r,
   /usr/share/wayland-sessions/{,*.desktop} r,
   /usr/share/xml/iso-codes/{,**} r,

apparmor.d/groups/gnome/loupe

@@ -17,7 +17,7 @@ profile loupe @{exec_path} flags=(attach_disconnected) {
   include <abstractions/user-read-strict>
   include <abstractions/user-write-strict>
 
-  signal (send) set=(kill) peer=loupe//bwrap,
+  signal send set=kill peer=loupe//bwrap,
 
   #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}"
 

apparmor.d/groups/gnome/org.gnome.NautilusPreviewer

@@ -7,7 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{exec_path} = @{lib}/org.gnome.NautilusPreviewer
-profile org.gnome.NautilusPreviewer @{exec_path} {
+profile org.gnome.NautilusPreviewer @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/audio-client>
   include <abstractions/dconf-write>

apparmor.d/groups/network/networkd-dispatcher

@@ -26,6 +26,7 @@ profile networkd-dispatcher @{exec_path} {
   @{bin}/sed         rix,
 
   @{lib}/networkd-dispatcher/routable.d/postfix rix,
+  @{lib}/NetworkManager/dispatcher.d/@{int}-chrony-onoffline rix,
 
   /etc/networkd-dispatcher/{,**} r,
 

apparmor.d/groups/pacman/yay

@@ -84,6 +84,7 @@ profile yay @{exec_path} {
 
     @{bin}/gpg{,2}     mr,
     @{bin}/gpg-agent  rPx,
+    @{bin}/dirmngr    rPx,
 
     owner @{HOME}/@{XDG_GPG_DIR}/ rw,
     owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,

apparmor.d/profiles-a-f/evince

@@ -49,7 +49,7 @@ profile evince @{exec_path} {
   owner @{user_config_dirs}/evince/{,*} rw,
 
   owner @{tmp}/*.pdf r,
-  owner @{tmp}/evince-*/{,**} rw,
+  owner @{tmp}/evince-@{int}/{,**} rw,
   owner @{tmp}/gtkprint* rw,
 
   owner @{PROC}/@{pid}/fd/ r,

apparmor.d/profiles-m-r/mkinitramfs

@@ -87,10 +87,11 @@ profile mkinitramfs @{exec_path} {
 
         /var/tmp/ r,
         /var/tmp/modules_@{rand6} rw,
-        /var/tmp/mkinitramfs_@{rand6}/@{lib}/modules/*/modules.{order,builtin} rw,
   owner /var/tmp/mkinitramfs_@{rand6} rw,
+  owner /var/tmp/mkinitramfs_@{rand6}/ rw,
   owner /var/tmp/mkinitramfs_@{rand6}/** rwl -> /var/tmp/mkinitramfs_*/**,
   owner /var/tmp/mkinitramfs-@{rand6} rw,
+  owner /var/tmp/mkinitramfs-*_@{rand6} rw,
 
   @{sys}/devices/platform/ r,
   @{sys}/devices/platform/**/ r,

apparmor.d/profiles-s-z/snap-seccomp

@@ -20,6 +20,8 @@ profile snap-seccomp @{exec_path} {
 
   @{lib_dirs}/**.so* mr,
 
+  @{bin}/getent rix,
+
   /var/lib/snapd/seccomp/bpf/{,**} rw,
 
   owner @{PROC}/@{pids}/mountinfo r,

apparmor.d/profiles-s-z/spotify

@@ -26,6 +26,7 @@ profile spotify @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mrix,
 
+  @{sh_path} mr,
   @{bin}/grep rix,
 
   @{open_path}     rPx -> child-open-strict,
@@ -44,6 +45,7 @@ profile spotify @{exec_path} flags=(attach_disconnected) {
   owner @{tmp}/.org.chromium.Chromium.@{rand6}/** rw,
 
         @{PROC}/pressure/* r,
+        @{PROC}/@{pid}/net/unix r,
   owner @{PROC}/@{pid}/clear_refs w,
 
   /dev/tty rw,

apparmor.d/profiles-s-z/steam-game-proton

@@ -76,6 +76,7 @@ profile steam-game-proton @{exec_path} flags=(attach_disconnected,complain) {
 
   owner @{share_dirs}/*.dll r,
   owner @{share_dirs}/bin/ r,
+  owner @{share_dirs}/installscriptevalutor_log.txt rw,
   owner @{share_dirs}/legacycompat/ r,
   owner @{share_dirs}/legacycompat/** mr,
   owner @{share_dirs}/steamapps/compatdata/{,**} rwk,

apparmor.d/profiles-s-z/tlp

@@ -45,7 +45,7 @@ profile tlp @{exec_path} flags=(attach_disconnected) {
   @{bin}/readlink               rix,
   @{bin}/rm                     rix,
   @{bin}/sort                   rix,
-  @{bin}/systemctl              rCx ->  systemctl,
+  @{bin}/systemctl              rCx -> systemctl,
   @{bin}/touch                  rix,
   @{bin}/tr                     rix,
   @{bin}/udevadm                rCx -> udevadm,
@@ -63,30 +63,33 @@ profile tlp @{exec_path} flags=(attach_disconnected) {
   /var/lib/tlp/{,**} rw,
   /var/lib/power-profiles-daemon/state.ini rw,
 
+  owner /tmp/tlp-run.conf_tmp@{rand6} rw,
+
   owner @{run}/tlp/{,**} rw,
   owner @{run}/tlp/lock_tlp  rwk,
 
   @{run}/udev/data/+platform:* r,
 
+  @{sys}/bus/pci/devices/ r,
+  @{sys}/devices/@{pci}/{,**/}power/control w,
   @{sys}/devices/system/cpu/cpufreq/policy@{int}/energy_performance_preference rw,
-  @{sys}/module/pcie_aspm/parameters/policy rw,
-  @{sys}/module/snd_hda_intel/parameters/power_save rw,
-  @{sys}/module/snd_hda_intel/parameters/power_save_controller rw,
   @{sys}/firmware/acpi/platform_profile* rw,
   @{sys}/firmware/acpi/pm_profile* rw,
+  @{sys}/module/*/parameters/power_save rw,
+  @{sys}/module/*/parameters/power_save_controller rw,
+  @{sys}/module/pcie_aspm/parameters/policy rw,
 
   owner @{PROC}/sys/fs/xfs/xfssyncd_centisecs rw,
   owner @{PROC}/sys/kernel/nmi_watchdog rw,
   owner @{PROC}/sys/vm/dirty_*_centisecs rw,
   owner @{PROC}/sys/vm/laptop_mode rw,
 
-  /dev/disk/by-id/ r,
-  /dev/tty rw,
-
   profile systemctl {
     include <abstractions/base>
     include <abstractions/app/systemctl>
 
+    capability net_admin,
+
     include if exists <local/tlp_systemctl>
   }