feat(profile) add the display-manager group.

- Group all display manager profile in the same group
- Ensure unsuported display manager can start a DE without breaking.

apparmor.d/groups/display-manager/lightdm

@@ -11,16 +11,14 @@ include <tunables/global>
 profile lightdm @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/authentication>
+  include <abstractions/desktop>
   include <abstractions/fontconfig-cache-read>
-  include <abstractions/fonts>
-  include <abstractions/freedesktop.org>
   include <abstractions/nameservice-strict>
   include <abstractions/wutmp>
-  include <abstractions/X>
 
-  audit capability sys_nice,
   capability audit_write,
   capability chown,
+  capability dac_override,
   capability dac_read_search,
   capability fowner,
   capability fsetid,
@@ -33,23 +31,24 @@ profile lightdm @{exec_path} flags=(attach_disconnected) {
 
   network netlink raw,
 
-  signal (send) set=(term, kill, usr1),
+  signal (send) set=(term) peer=lightdm-*-greeter,
   signal (receive) set=(usr1) peer=xorg,
 
   @{exec_path} mrix,
 
-  @{bin}/rm rix,
+  @{bin}/rm     rix,
 
-  @{bin}/lightdm-gtk-greeter   rPx,
+  @{bin}/lightdm-*-greeter    rPUx,
   @{bin}/startx                rPx,
   @{bin}/Xorg                  rPx,
   @{bin}/plymouth              rPx,
   @{bin}/gnome-keyring-daemon  rPx,
 
-  @{lib}/security-misc/* rPUx, #aa:only whonix
+  @{lib}/security-misc/*       rPx, #aa:only whonix
   @{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx,
 
-  /etc/X11/Xsession            rPUx,
+  /etc/lightdm/Xsession        rPx,
+  /etc/X11/Xsession            rPx,
 
   /usr/share/lightdm/{,**} r,
   /usr/share/wayland-sessions/{,*.desktop} r,
@@ -58,10 +57,13 @@ profile lightdm @{exec_path} flags=(attach_disconnected) {
   /etc/default/locale r,
   /etc/environment r,
   /etc/lightdm/{,**} r,
+  /etc/machine-id r,
   /etc/security/limits.d/{,*} r,
+  /etc/shells r,
 
   /var/cache/lightdm/dmrc/*.dmrc* rw,
   /var/lib/lightdm/{,**} rw,
+  /var/lib/lightdm-data/{,**} rw,
   /var/log/lightdm/{,**} rw,
 
   owner @{HOME}/.dmrc r,
@@ -72,7 +74,7 @@ profile lightdm @{exec_path} flags=(attach_disconnected) {
         @{run}/faillock/user rwk,
         @{run}/lightdm.pid rw,
         @{run}/lightdm/{,**} rw,
-  owner @{run}/systemd/sessions/@{int}.ref rw,
+  owner @{run}/systemd/sessions/*.ref rw,
 
         @{PROC}/1/limits r,
         @{PROC}/cmdline r,

apparmor.d/groups/display-manager/lightdm-gtk-greeter

@@ -10,12 +10,10 @@ include <tunables/global>
 @{exec_path} = @{bin}/lightdm-gtk-greeter
 profile lightdm-gtk-greeter @{exec_path} {
   include <abstractions/base>
-  include <abstractions/dri-enumerate>
+  include <abstractions/desktop>
   include <abstractions/fontconfig-cache-read>
-  include <abstractions/fonts>
-  include <abstractions/freedesktop.org>
+  include <abstractions/graphics>
   include <abstractions/nameservice-strict>
-  include <abstractions/X>
 
   signal (receive) set=(term, kill) peer=lightdm,
 
@@ -26,6 +24,7 @@ profile lightdm-gtk-greeter @{exec_path} {
   @{lib}/systemd/systemd rCx -> systemd,
   @{lib}/{,at-spi2{,-core}/}at-spi-bus-launcher rPx,
 
+  /usr/share/backgrounds/xfce/{,**} r,
   /usr/share/desktop-base/{,**} r,
   /usr/share/lightdm/{,**} r,
   /usr/share/wayland-sessions/{,*.desktop} r,

apparmor.d/groups/display-manager/lightdm-xsession

@@ -0,0 +1,52 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /etc/lightdm/Xsession
+profile lightdm-xsession @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+  include <abstractions/nameservice-strict>
+  include <abstractions/shells>
+
+  @{exec_path} mr,
+
+  @{sh_path}         rix,
+  @{bin}/cat         rix,
+  @{bin}/tr          rix,
+  @{bin}/tty         rix,
+
+  @{bin}/dbus-update-activation-environment  rCx -> dbus,
+  @{bin}/startxfce4                          rPx,
+  @{bin}/systemctl                           rCx -> systemctl,
+
+  /etc/X11/xinit/xinitrc.d/{,**} r,
+  /etc/debuginfod/{,**} r,
+
+  owner @{HOME}/.xsession-errors w,
+
+  profile systemctl {
+    include <abstractions/base>
+    include <abstractions/app/systemctl>
+  
+    owner @{HOME}/.xsession-errors w,
+
+    include if exists <local/lightdm-xsession_systemctl>
+  }
+
+  profile dbus {
+    include <abstractions/base>
+
+    @{bin}/dbus-update-activation-environment mr,
+
+    owner @{HOME}/.xsession-errors w,
+
+    include if exists <local/lightdm-xsession_dbus>
+  }
+
+  include if exists <local/lightdm-xsession>
+}

apparmor.d/groups/display-manager/x11-xsession

@@ -74,8 +74,9 @@ profile x11-xsession @{exec_path} {
   
     @{bin}/ssh-agent mr,
 
-    audit @{bin}/gpg-agent             rPx,
     @{sh_path}                   rix,
+
+    @{bin}/gpg-agent             rPx,
     @{bin}/enlightenment_start  rPUx,
     @{bin}/env                   rix,
     @{bin}/im-launch             rPx,