diff --git a/apparmor.d/groups/cron/cron b/apparmor.d/groups/cron/cron index 24ad8a89..db61ef22 100644 --- a/apparmor.d/groups/cron/cron +++ b/apparmor.d/groups/cron/cron @@ -8,7 +8,7 @@ abi , include @{exec_path} = /{usr/,}{s,}bin/cron -profile cron @{exec_path} { +profile cron @{exec_path} flags=(attach_disconnected) { include include include @@ -45,6 +45,7 @@ profile cron @{exec_path} { /var/spool/cron/crontabs/{,*} r, + @{run}/systemd/sessions/*.ref rw, owner @{run}/crond.pid rwk, owner @{run}/crond.reboot rw, diff --git a/apparmor.d/groups/gpg/gpg-agent b/apparmor.d/groups/gpg/gpg-agent index 5d501337..22b089c7 100644 --- a/apparmor.d/groups/gpg/gpg-agent +++ b/apparmor.d/groups/gpg/gpg-agent @@ -70,6 +70,11 @@ profile gpg-agent @{exec_path} { owner /var/lib/*/gnupg/{,d.*/}S.gpg-agent{,.ssh,.browser,.extra} rw, owner /var/lib/*/gnupg/sshcontrol r, + owner /var/tmp/zypp.*/ rw, + owner /var/tmp/zypp.*/{,*/}private-keys-v1.d/ rw, + owner /var/tmp/zypp.*/{,*/}private-keys-v1.d/@{hex}.key rw, + owner /var/tmp/zypp.*/{,*/}S.gpg-agent{,.ssh,.browser,.extra} rw, + owner /tmp/tmp.*/gnupg/ rw, owner /tmp/tmp.*/gnupg/private-keys-v1.d/ rw, owner /tmp/tmp.*/gnupg/private-keys-v1.d/@{hex}.key rw, diff --git a/apparmor.d/groups/gpg/scdaemon b/apparmor.d/groups/gpg/scdaemon index a730a6dc..01d59c0f 100644 --- a/apparmor.d/groups/gpg/scdaemon +++ b/apparmor.d/groups/gpg/scdaemon @@ -24,7 +24,9 @@ profile scdaemon @{exec_path} { owner @{run}/user/@{uid}/gnupg/S.scdaemon rw, owner @{run}/user/@{uid}/gnupg/d.*/S.scdaemon rw, - owner /var/tmp/zypp.??????/zypp-trusted-*/S.scdaemon w, + owner /var/tmp/zypp.*/PublicKey/S.scdaemon w, + owner /var/tmp/zypp.*/zypp-general-kr*/S.scdaemon w, + owner /var/tmp/zypp.*/zypp-trusted-*/S.scdaemon w, @{PROC}/@{pid}/task/@{tid}/comm rw, diff --git a/apparmor.d/profiles-s-z/sddm b/apparmor.d/profiles-s-z/sddm index 316cd9fb..bdb9cd5c 100644 --- a/apparmor.d/profiles-s-z/sddm +++ b/apparmor.d/profiles-s-z/sddm @@ -66,6 +66,8 @@ profile sddm @{exec_path} { @{exec_path} mr, /{usr/,}lib/@{multiarch}/sddm/sddm-helper rix, + /{usr/,}lib{,exec}/sddm/sddm-helper rix, + /{usr/,}bin/{,ba,da}sh mrix, /{usr/,}bin/sddm-greeter rPx,