From 8f1fff89ab369d699cbb31e01a6b3cd18246aec2 Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Sun, 10 Mar 2024 14:56:18 +0000
Subject: [PATCH] feat(abs): minor improvments.

---
 apparmor.d/abstractions/bwrap     | 8 +++-----
 apparmor.d/abstractions/user-read | 4 +++-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/apparmor.d/abstractions/bwrap b/apparmor.d/abstractions/bwrap
index 192cf5b7..ae748733 100644
--- a/apparmor.d/abstractions/bwrap
+++ b/apparmor.d/abstractions/bwrap
@@ -4,7 +4,9 @@
 
 # Minimal set of rules for bwrap
 
-# A profile using this abstaction still needs to include: @{bin}/bwrap rix,
+# A profile using this abstaction still needs to set:
+# - the attach_disconnected flag
+# - bwrap execution: '@{bin}/bwrap rix,'
 
   capability net_admin,
   capability setpcap,
@@ -36,10 +38,6 @@
   owner /tmp/newroot/ w,
   owner /tmp/oldroot/ w,
 
-  @{sys}/fs/cgroup/user.slice/cpu.max r,
-  @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r,
-  @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r,
-  @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r,
 
         @{PROC}/sys/kernel/overflowgid r,
         @{PROC}/sys/kernel/overflowuid r,
diff --git a/apparmor.d/abstractions/user-read b/apparmor.d/abstractions/user-read
index 71e733cc..cfc908ad 100644
--- a/apparmor.d/abstractions/user-read
+++ b/apparmor.d/abstractions/user-read
@@ -5,8 +5,10 @@
 # This abstraction gives read access on all defined user directories. It should
 # only be used if access to **ALL** folders is required.
 
-  owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
+  owner @{HOME}/@{XDG_DESKTOP_DIR}/{,**} r,
   owner @{HOME}/@{XDG_SCREENSHOTS_DIR}/{,**} r,
+  owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
+  owner @{MOUNTS}/@{XDG_DESKTOP_DIR}/{,**} r,
   owner @{MOUNTS}/@{XDG_SCREENSHOTS_DIR}/{,**} r,
   owner @{MOUNTS}/@{XDG_WALLPAPERS_DIR}/{,**} r,