feat(profile): general update.

apparmor.d/groups/bus/ibus-extension-gtk3

@@ -48,12 +48,13 @@ profile ibus-extension-gtk3 @{exec_path} flags=(attach_disconnected) {
   /usr/share/icons/{,**} r,
   /usr/share/X11/xkb/** r,
 
-  owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r,
-  owner @{run}/user/@{uid}/gdm/Xauthority r,
-
   /var/lib/gdm{3,}/.config/ibus/bus/@{md5}-unix-{,wayland-}@{int} r,
   /var/lib/gdm{3,}/.config/dconf/user r,
   /var/lib/gdm{3,}/greeter-dconf-defaults r,
+  /var/lib/gdm{3,}/.config/ibus/bus/ r,
+
+  owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r,
+  owner @{run}/user/@{uid}/gdm/Xauthority r,
 
   # file inherit
   /dev/tty@{int} rw,

apparmor.d/groups/freedesktop/xdg-document-portal

@@ -42,14 +42,12 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
 
   owner @{run}/user/@{uid}/doc/ rw,
 
-  owner @{PROC}/@{pid}/fd/ r,
-  owner @{PROC}/@{pid}/cgroup r,
         @{PROC}/1/cgroup r,
         @{PROC}/sys/fs/pipe-max-size r,
+  owner @{PROC}/@{pid}/cgroup r,
+  owner @{PROC}/@{pid}/fd/ r,
 
           /dev/fuse rw,
-
-  # file inherit
     owner /dev/tty@{int} rw,
 
   profile fusermount {
@@ -76,6 +74,7 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
     @{PROC}/@{pids}/mounts r,
 
           /dev/fuse rw,
+    owner /dev/tty@{int} rw,
   
     include if exists <local/xdg-document-portal_fusermount>
   }

apparmor.d/groups/gnome/gdm-xsession

@@ -13,6 +13,7 @@ profile gdm-xsession @{exec_path} {
   include <abstractions/consoles>
   include <abstractions/dconf-write>
   include <abstractions/nameservice-strict>
+  include <abstractions/openssl>
 
   @{exec_path} mr,
 

apparmor.d/groups/gnome/gnome-initial-setup

@@ -31,6 +31,7 @@ profile gnome-initial-setup @{exec_path} {
   @{lib}/gnome-initial-setup-goa-helper rix,
 
   /usr/share/dconf/profile/gdm r,
+  /usr/share/xml/iso-codes/{,**} r,
 
   /var/lib/gdm{,3}/greeter-dconf-defaults r,
 

apparmor.d/groups/gnome/org.gnome.NautilusPreviewer

@@ -26,6 +26,7 @@ profile org.gnome.NautilusPreviewer @{exec_path} {
 
   @{open_path}         rPx -> child-open,
 
+  /usr/share/poppler/{,**} r,
   /usr/share/sushi/org.gnome.NautilusPreviewer.*.gresource r,
 
   /etc/machine-id r,

apparmor.d/profiles-s-z/switcheroo-control

@@ -11,6 +11,7 @@ profile switcheroo-control @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus-system>
 
+  capability net_admin,
   capability sys_nice,
 
   network netlink raw,