Ubuntu compatibility

apparmor.d/abstractions/nvidia.d/complete

@@ -5,3 +5,7 @@
   owner @{user_cache_dirs}/nvidia/ w,
   owner @{user_cache_dirs}/nvidia/GLCache/ rw,
   owner @{user_cache_dirs}/nvidia/GLCache/** rwk,
+
+  @{run}/nvidia-xdriver-* w,
+
+  unix (send, receive) type=dgram peer=(addr="@var/run/nvidia-xdriver-*"),

apparmor.d/abstractions/ubuntu-unity7-base.d/complete

@@ -0,0 +1,12 @@
+
+  dbus send
+    bus=session
+    path=/org/gtk/vfs/mounttracker
+    interface=org.gtk.vfs.MountTracker
+    member=ListMountableInfo,
+
+  dbus send
+    bus=session
+    path=/org/gtk/vfs/Daemon
+    interface=org.gtk.vfs.Daemon
+    member=ListMonitorImplementations,

apparmor.d/abstractions/vulkan.d/complete

@@ -0,0 +1,4 @@
+# apparmor.d - Full set of apparmor profiles
+# SPDX-License-Identifier: GPL-2.0-only
+
+  /usr/share/egl/egl_external_platform.d/{,*} r,

apparmor.d/groups/apps/thunderbird

@@ -3,7 +3,6 @@
 # SPDX-License-Identifier: GPL-2.0-only
 # Useful info:
 # http://kb.mozillazine.org/Files_and_folders_in_the_profile_-_Thunderbird
-#
 
 abi <abi/3.0>,
 
@@ -19,6 +18,9 @@ profile thunderbird @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/opencl-intel>
+  include <abstractions/nvidia>
+  include <abstractions/vulkan>
+  include <abstractions/mesa>
   include <abstractions/gtk>
   include <abstractions/fonts>
   include <abstractions/fontconfig-cache-read>
@@ -27,9 +29,14 @@ profile thunderbird @{exec_path} {
   include <abstractions/enchant>
   include <abstractions/user-download-strict>
   include <abstractions/thumbnails-cache-read>
-  include <abstractions/mesa>
   include <abstractions/nameservice-strict>
   include <abstractions/openssl>
+  include <abstractions/deny-root-dir-access>
+  include <abstractions/dconf>
+  include <abstractions/ibus>
+  include <abstractions/dbus-strict>
+  include <abstractions/dbus-session-strict>
+  include if exists <abstractions/ubuntu-unity7-base>
 
   ptrace peer=@{profile_name},
 
@@ -91,10 +98,6 @@ profile thunderbird @{exec_path} {
   owner @{HOME}/Mail/ rw,
   owner @{HOME}/Mail/** rwl -> @{HOME}/Mail/**,
 
-  include <abstractions/dconf>
-  owner @{run}/user/@{uid}/dconf/ rw,
-  owner @{run}/user/@{uid}/dconf/user rw,
-
   # Fix error in libglib while saving files as
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
@@ -115,6 +118,10 @@ profile thunderbird @{exec_path} {
   owner @{user_config_dirs}/qt5ct/{,**} r,
   /usr/share/qt5ct/** r,
 
+  # gnome-tiny
+  /etc/gnome/defaults.list r,
+  @{run}/mount/utab r,
+
   deny @{sys}/devices/system/cpu/present r,
   deny @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
   deny @{sys}/devices/system/cpu/cpu[0-9]/cache/index[0-9]/size r,
@@ -124,6 +131,7 @@ profile thunderbird @{exec_path} {
        owner @{PROC}/@{pid}/stat r,
        owner @{PROC}/@{pid}/statm r,
        owner @{PROC}/@{pid}/smaps r,
+       owner @{PROC}/@{pids}/comm r,
   deny owner @{PROC}/@{pids}/cmdline r,
   deny owner @{PROC}/@{pids}/environ r,
        owner @{PROC}/@{pid}/task/ r,
@@ -138,9 +146,6 @@ profile thunderbird @{exec_path} {
   # for dig
        owner @{PROC}/@{pid}/task/@{tid}/comm rw,
 
-  /var/lib/dbus/machine-id r,
-  /etc/machine-id r,
-
   # TMP files
         /var/tmp/ r,
         /tmp/ r,
@@ -151,7 +156,7 @@ profile thunderbird @{exec_path} {
   owner /tmp/mozilla_*/* rw,
   owner /tmp/MozillaMailnews/ rw,
   owner /tmp/MozillaMailnews/*.msf rw,
-  owner /tmp/Temp-@{uuid}/ rw,
+  owner /tmp/Temp-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*/ rw,
 
    deny /dev/ r,
         /dev/urandom w,
@@ -181,15 +186,46 @@ profile thunderbird @{exec_path} {
   /{usr/,}bin/gpgsm             rCx -> gpg,
 
   # Allowed apps to open
-  /{usr/,}lib/firefox/firefox rPUx,
+  /{usr/,}lib/firefox/firefox rPx,
-  /{usr/,}bin/qpdfview        rPUx,
+  /{usr/,}bin/qpdfview        rPx,
   /{usr/,}bin/viewnior        rPUx,
-  /{usr/,}bin/engrampa        rPUx,
+  /{usr/,}bin/engrampa        rPx,
-  /{usr/,}bin/geany           rPUx,
+  /{usr/,}bin/geany           rPx,
 
   # file_inherit
   owner /dev/tty[0-9]* rw,
+  owner @{HOME}/.xsession-errors w,
 
+  # DBus
+  dbus send
+    bus=system
+    path=/org/freedesktop/RealtimeKit[0-9]
+    member={Get,MakeThreadHighPriority,MakeThreadRealtime}
+    peer=(name=org.freedesktop.RealtimeKit[0-9]),
+
+  dbus send
+    bus=session
+    path=/ca/desrt/dconf/Writer/user
+    interface=ca.desrt.dconf.Writer
+    member={Change,Notify}
+    peer=(name=ca.desrt.dconf),
+
+  dbus send
+    bus=system
+    path=/org/freedesktop/UPower
+    interface=org.freedesktop.UPower
+    member=EnumerateDevices
+    peer=(name=org.freedesktop.UPower),
+
+  # dconf write
+  owner @{HOME}/.config/dconf/     rw,
+  owner @{HOME}/.config/dconf/user rw,
+  owner @{run}/user/@{uids}/dconf/user rw,
+
+  owner @{run}/user/@{uid}/ICEauthority r,
+
+  @{sys}/cgroup/cpu,cpuacct/user.slice/cpu.cfs_quota_us r,
+  @{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r,
 
   profile gpg {
     include <abstractions/base>
@@ -238,6 +274,7 @@ profile thunderbird @{exec_path} {
     deny owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* rw,
          owner /tmp/ns* rw,
 
+    include if exists <local/thunderbird_gpg>
   }
 
   profile open {
@@ -249,7 +286,7 @@ profile thunderbird @{exec_path} {
     /{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr,
 
     /{usr/,}bin/{,ba,da}sh      rix,
-    /{usr/,}bin/gawk            rix,
+    /{usr/,}bin/{,m,g}awk       rix,
     /{usr/,}bin/readlink        rix,
     /{usr/,}bin/basename        rix,
 
@@ -258,15 +295,16 @@ profile thunderbird @{exec_path} {
     owner @{run}/user/@{uid}/ r,
 
     # Allowed apps to open
-    /{usr/,}lib/firefox/firefox rPUx,
+    /{usr/,}lib/firefox/firefox rPx,
-    /{usr/,}bin/qpdfview        rPUx,
+    /{usr/,}bin/qpdfview        rPx,
     /{usr/,}bin/viewnior        rPUx,
-    /{usr/,}bin/engrampa        rPUx,
+    /{usr/,}bin/engrampa        rPx,
-    /{usr/,}bin/geany           rPUx,
+    /{usr/,}bin/geany           rPx,
 
     # file_inherit
     owner @{HOME}/.xsession-errors w,
 
+    include if exists <local/thunderbird_open>
   }
 
   include if exists <local/thunderbird>