Debian 12 Gnome DE

apparmor.d/groups/apps/vlc

@@ -198,6 +198,7 @@ profile vlc @{exec_path} {
 
   # Silencer
   deny @{lib}/@{multiarch}/vlc/{,**} w,
+  deny @{user_share_dirs}/gvfs-metadata/{*,} r,
 
   profile xdg-screensaver {
     include <abstractions/base>

apparmor.d/groups/apt/apt-extracttemplates

@@ -13,6 +13,8 @@ profile apt-extracttemplates @{exec_path} {
   include <abstractions/consoles>
   include <abstractions/apt-common>
 
+  capability dac_read_search,
+
   @{exec_path} mr,
 
   @{bin}/dpkg rPx -> child-dpkg,

apparmor.d/groups/apt/apt-key

@@ -15,7 +15,9 @@ profile apt-key @{exec_path} {
   @{exec_path} mr,
 
   @{bin}/{,ba,da}sh rix,
-  @{bin}/{,e}grep   rix,
+  @{bin}/{,e,f}grep rix,
+  @{bin}/{,m,g}awk  rix,
+  @{bin}/base64     rix,
   @{bin}/cat        rix,
   @{bin}/chmod      rix,
   @{bin}/cmp        rix,
@@ -27,6 +29,7 @@ profile apt-key @{exec_path} {
   @{bin}/mktemp     rix,
   @{bin}/readlink   rix,
   @{bin}/rm         rix,
+  @{bin}/mv         rix,
   @{bin}/sed        rix,
   @{bin}/sort       rix,
   @{bin}/touch      rix,
@@ -50,7 +53,7 @@ profile apt-key @{exec_path} {
   /root/ r,
 
   /etc/apt/trusted.gpg r,
-  /etc/apt/trusted.gpg.d/{,*.gpg} r,
+  /etc/apt/trusted.gpg.d/{,*.gpg,*.asc} r,
 
         /tmp/ r,
   owner /tmp/apt-key-gpghome.*/{,**} rw,
@@ -99,6 +102,7 @@ profile apt-key @{exec_path} {
     owner @{PROC}/@{pid}/fd/ r,
     owner @{PROC}/@{pid}/task/@{tid}/comm rw,
 
+    include if exists <local/apt-key_pgp>
   }
 
   include if exists <local/apt-key>

apparmor.d/groups/apt/apt-methods-rred

@@ -23,6 +23,7 @@ profile apt-methods-rred @{exec_path} {
   signal (receive) peer=apt-get,
   signal (receive) peer=aptitude,
   signal (receive) peer=synaptic,
+  signal (receive) set=(int) peer=packagekitd,
 
   @{exec_path} mr,
 

apparmor.d/groups/apt/dpkg-preconfigure

@@ -35,12 +35,17 @@ profile dpkg-preconfigure @{exec_path} {
   owner /tmp/*.template.* rw,
   owner /tmp/*.config.* rwPUx,
 
+        /var/lib/dbus/machine-id r,
   owner /var/cache/debconf/ rw,
   owner /var/cache/debconf/{config,passwords,templates}.dat{,-old,-new} rwk,
+  owner /var/cache/debconf/tmp.ci/ r,
   owner /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
 
+  @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r,
   @{run}/user/@{uid}/pk-debconf-socket rw,
 
+  owner @{PROC}/@{pid}/fd/ r,
+
   # The following is needed when dpkg-preconfigure uses debcconf GUI frontends.
   include <abstractions/gtk>
   include <abstractions/fonts>

apparmor.d/groups/apt/synaptic

@@ -64,8 +64,9 @@ profile synaptic @{exec_path} {
   @{exec_path} mr,
 
   @{bin}/{,ba,da}sh rix,
+  @{bin}/{,e,f}grep rix,
   @{bin}/test       rix,
-  @{bin}/{,e}grep   rix,
+  @{bin}/echo       rix,
 
   # For update-apt-xapian-index
   @{bin}/nice       rix,
@@ -81,6 +82,7 @@ profile synaptic @{exec_path} {
   #@{bin}/dbus-send          rCx -> dbus,
   deny @{bin}/dbus-launch rx,
   deny @{bin}/dbus-send   rx,
+  deny @{bin}/gdbus       rx,
 
   @{bin}/ps                 rPx,
   @{bin}/dpkg               rPx,
@@ -99,6 +101,7 @@ profile synaptic @{exec_path} {
   @{bin}/deborphan          rPx,
   @{bin}/tasksel            rPx,
   @{bin}/pkexec             rPx,
+  @{bin}/software-properties-gtk rPx,
 
   # Methods to use to download packages from the net
   @{lib}/apt/methods/*      rPx,
@@ -139,6 +142,8 @@ profile synaptic @{exec_path} {
   owner @{HOME}/.synaptic/** rwk,
   @{run}/synaptic.socket w,
 
+  @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r,
+
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mountinfo r,
 
@@ -158,6 +163,7 @@ profile synaptic @{exec_path} {
   # file_inherit
   owner /dev/tty@{int} rw,
 
+  deny @{user_share_dirs}/gvfs-metadata/{*,} r,
 
   profile dbus {
     include <abstractions/base>

apparmor.d/groups/bus/ibus-x11

@@ -21,6 +21,12 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) {
 
   unix (connect, receive, send) type=stream peer=(label=ibus-daemon),
 
+  network inet stream,
+  network inet6 stream,
+  network inet dgram,
+  network inet6 dgram,
+  network netlink raw,
+
   dbus send bus=session path=/org/a11y/bus
        interface=org.a11y.Bus
        member=GetAddress

apparmor.d/groups/children/child-open

@@ -76,7 +76,7 @@ profile child-open {
   @{bin}/gnome-calculator rPUx,
   @{bin}/gnome-disk-image-mounter rPx,
   @{bin}/gnome-disks       rPx,
-  @{bin}/gwenview          rPUx,
+  @{bin}/gwenview         rPUx,
   @{bin}/kgx               rPx,
   @{bin}/okular            rPx,
   @{bin}/qbittorrent       rPx,
@@ -88,8 +88,9 @@ profile child-open {
   @{bin}/thunderbird       rPx,
   @{bin}/transmission-gtk  rPx,
   @{bin}/viewnior         rPUx,
-  @{bin}/vlc               rPUx,
+  @{bin}/vlc              rPUx,
   @{bin}/xarchiver         rPx,
+  @{bin}/xbrlapi 	   rPx,
   @{lib}/libreoffice/program/{soffice,soffice.bin,oosplash} rPUx,
 
   

apparmor.d/groups/freedesktop/accounts-daemon

@@ -47,6 +47,7 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) {
   @{bin}/cat         rix,
   @{bin}/chage       rPx,
   @{bin}/passwd      rPx,
+  @{bin}/chpasswd    rPx,
   @{bin}/userdel     rPx,
   @{bin}/usermod     rPx,
   @{bin}/locale     rPUx,

apparmor.d/groups/freedesktop/geoclue

@@ -75,6 +75,7 @@ profile geoclue @{exec_path} flags=(attach_disconnected) {
   /etc/geoclue/{,**} r,
 
   /var/lib/nscd/services r,
+  /var/lib/dbus/machine-id r,
 
   @{run}/systemd/journal/socket rw,
 

apparmor.d/groups/freedesktop/plymouthd

@@ -19,6 +19,7 @@ profile plymouthd @{exec_path} {
   network netlink raw,
 
   signal (send) peer=unconfined,
+  signal (send) set=(rtmin+23) peer=systemd-shutdown,
 
   ptrace (read) peer=plymouth,
 

apparmor.d/groups/freedesktop/xdg-user-dirs-update

@@ -48,6 +48,7 @@ profile xdg-user-dirs-update @{exec_path} {
   owner @{HOME}/@{XDG_PUBLICSHARE_DIR}/ w,
   owner @{HOME}/@{XDG_TEMPLATES_DIR}/ w,
   owner @{HOME}/@{XDG_VIDEOS_DIR}/ w,
+  owner @{user_config_dirs}/ w,
 
   owner @{user_config_dirs}/user-dirs.dirs rw,
   owner @{user_config_dirs}/user-dirs.dirs@{rand6} rw,

apparmor.d/groups/gnome/gdm-session-worker

@@ -19,6 +19,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
   capability dac_override,
   capability dac_read_search,
   capability fowner,
+  capability fsetid,
   capability kill,
   capability net_admin,
   capability setgid,
@@ -107,5 +108,10 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
   /dev/tty rw,
   /dev/tty@{int} rw,
 
+  # Add user; set password on first login
+  /etc/.pwd.lock wk,
+  /etc/nshadow rw,
+  /etc/shadow w,
+
   include if exists <local/gdm-session-worker>
 }

apparmor.d/groups/gnome/gnome-control-center

@@ -132,6 +132,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
 
   owner @{HOME}/.cat_installer/ca.pem r,
   owner @{HOME}/.cert/nm-openvpn/*.pem r,
+  owner @{HOME}/.face r,
   owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
   owner @{user_cache_dirs}/gnome-control-center/{,**} rw,
   owner @{user_cache_dirs}/thumbnails/{,**} rw,

apparmor.d/groups/gnome/gnome-session-binary

@@ -153,9 +153,8 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
   @{lib}/gnome-session-failed                          rix,
   @{lib}/gsd-*                                         rPx,
 
-  # TODO: rCx gio-launch-desktop and put all the following program in this
-  #       subprofile. Not done yet as it breaks compatibility with Ubuntu/Debian
   @{lib}/gio-launch-desktop                            rix,
+  @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop   rix,
 
   @{bin}/aa-notify                                       rPx,
   @{bin}/baloo_file                                      rPx,

apparmor.d/groups/gnome/gnome-shell

@@ -473,6 +473,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   @{bin}/Xwayland         rPx,
   @{lib}/polkit-1/polkit* rPx,
   @{lib}/*                rPUx,
+  @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop rix,
 
   /usr/share/gnome-shell/extensions/ding@rastersoft.com/ding.js rPx,
 
@@ -506,8 +507,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
 
   /.flatpak-info r,
   /etc/fstab r,
-  /etc/udev/hwdb.bin r,
   /etc/pipewire/client.conf.d/{,**} r,
+  /etc/timezone r,
+  /etc/udev/hwdb.bin r,
   /etc/xdg/menus/gnome-applications.menu r,
 
   /var/lib/gdm{3,}/.cache/ w,
@@ -542,6 +544,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
 
   /var/lib/snapd/desktop/icons/{,**} r,
 
+  owner @{HOME}/.face r,
   owner @{HOME}/.mozilla/firefox/firefox-mpris/{,*} r,
   owner @{HOME}/.var/app/**/ r,
   owner @{HOME}/.var/app/**.{png,jpg,svg} r,
@@ -555,6 +558,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   owner @{user_config_dirs}/ibus/ w,
   owner @{user_config_dirs}/monitors.xml{,~} rwl,
   owner @{user_config_dirs}/pulse/ r,
+  owner @{user_config_dirs}/pulse/ w, # change to 'c'
   owner @{user_config_dirs}/tiling-assistant/{,**} rw,
 
   owner @{user_share_dirs}/backgrounds/{,**} rw,

apparmor.d/groups/gnome/gnome-software

@@ -61,6 +61,8 @@ profile gnome-software @{exec_path} {
   /var/cache/app-info/xmls/{,**} r,
   /var/cache/gio-@{int}.@{int}/gnome-mimeapps.list r,
 
+  /var/lib/apt/lists/*.yml.gz r,
+
   /var/lib/flatpak/app/{,**} r,
   /var/lib/flatpak/appstream/{,**} r,
   /var/lib/flatpak/repo/{,**} r,
@@ -68,6 +70,8 @@ profile gnome-software @{exec_path} {
   
   /var/lib/PackageKit/offline-update-competed r,
   /var/lib/PackageKit/prepared-update r,
+  /var/lib/swcatalog/icons/**.png r,
+  /var/lib/swcatalog/yaml/ r,
 
   /var/tmp/flatpak-cache-*/ rw,
   /var/tmp/flatpak-cache-*/** rwkl,

apparmor.d/groups/gnome/gnome-system-monitor

@@ -29,6 +29,7 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
   @{bin}/pkexec rPx,
 
   /usr/share/gnome-system-monitor/{,**} r,
+  /usr/share/firefox-esr/browser/chrome/icons/default/*.png r,
 
   # freedesktop.org-strict
   /usr/share/pixmaps/{,**} r,
@@ -40,13 +41,14 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
   /var/lib/snapd/desktop/icons/ r,
 
   owner @{run}/user/@{uid}/doc/ rw,
+  owner @{run}/user/@{uid}/gnome-shell-disable-extensions w,
 
   @{run}/systemd/sessions/*     r,
   @{run}/systemd/sessions/*.ref r,
 
-  @{sys}/devices/@{pci}/net/*/statistics/collisions r,
+  @{sys}/devices/@{pci}/{,*/}net/*/statistics/collisions r,
-  @{sys}/devices/@{pci}/net/*/statistics/rx_{bytes,errors,packets} r,
+  @{sys}/devices/@{pci}/{,*/}net/*/statistics/rx_{bytes,errors,packets} r,
-  @{sys}/devices/@{pci}/net/*/statistics/tx_{bytes,errors,packets} r,
+  @{sys}/devices/@{pci}/{,*/}net/*/statistics/tx_{bytes,errors,packets} r,
   @{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/collisions r,
   @{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/rx_{bytes,errors,packets} r,
   @{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/tx_{bytes,errors,packets} r,

apparmor.d/groups/gnome/gsd-color

@@ -125,6 +125,8 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
   /usr/share/mime/mime.cache r,
   /usr/share/X11/xkb/** r,
 
+  /etc/timezone r,
+
   /var/lib/flatpak/exports/share/mime/mime.cache r,
   /var/lib/gdm{3,}/.config/dconf/user r,
   /var/lib/gdm{3,}/.local/share/icc/ rw,

apparmor.d/groups/gnome/tracker-extract

@@ -95,10 +95,14 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) {
   /etc/fstab r,
   /etc/libva.conf r,
 
+  # dri-common-strict
+  /usr/share/drirc.d/{,*.conf} r,
+
   /var/lib/gdm{3,}/.cache/ rw,
   /var/lib/gdm{3,}/.cache/tracker3/{,**} rw,
   /var/lib/gdm{3,}/.cache/gstreamer-1.0/ rw,
   /var/lib/gdm{3,}/.cache/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} rw,
+  /var/lib/gdm{3,}/.config/dconf/user r,
   /var/lib/gdm{3,}/greeter-dconf-defaults r,
 
   /var/lib/lightdm/.cache/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} r,
@@ -130,6 +134,9 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) {
 
   @{run}/mount/utab r,
 
+  @{sys}/devices/pci[0-9]*/*/vendor r,
+  @{sys}/devices/pci[0-9]*/*/device r,
+
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mountinfo r,
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,

apparmor.d/groups/gnome/tracker-miner

@@ -77,6 +77,7 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
 
   /etc/fstab r,
   /etc/blkid.conf r,
+  /etc/timezone r,
 
   /var/lib/flatpak/exports/share/applications/{,mimeinfo.cache} r,
   /var/lib/snapd/desktop/applications/{,mimeinfo.cache} r,
@@ -84,6 +85,7 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
   /var/lib/gdm{3,}/ r,
   /var/lib/gdm{3,}/.cache/tracker3/{,tracker3/}files/{,**} rwk,
   /var/lib/gdm{3,}/.local/share/applications/ r,
+  /var/lib/gdm{3,}/.config/dconf/user r,
   /var/lib/gdm{3,}/greeter-dconf-defaults r,
 
   /var/lib/lightdm/.config/dconf/user r,

apparmor.d/groups/network/nm-dispatcher

@@ -77,6 +77,7 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
 
     /etc/network/if-*.d/ r,
     /etc/network/if-*.d/* rPUx,
+    /etc/wpa_supplicant/ifupdown.sh rPUx,
 
     include if exists <local/anacron_run_parts>
   }

apparmor.d/groups/ssh/ssh-agent-launch

@@ -17,10 +17,11 @@ profile ssh-agent-launch @{exec_path} {
   @{bin}/grep           rix,
   @{bin}/ssh-agent      rPx,
 
+  /etc/X11/Xsession.options r,
+
   profile dbus {
     include <abstractions/base>
 
-
     @{bin}/dbus-update-activation-environment mr,
 
     include if exists <local/ssh-agent-launch_dbus>

apparmor.d/groups/systemd/systemd-oomd

@@ -33,7 +33,7 @@ profile systemd-oomd @{exec_path} flags=(attach_disconnected) {
 
   @{sys}/fs/cgroup/cgroup.controllers r,
   @{sys}/fs/cgroup/memory.pressure r,
-  @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}0.service/memory.* r,
+  @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/memory.* r,
 
   @{PROC}/pressure/{cpu,io,memory} r,
 

apparmor.d/groups/systemd/systemd-shutdown

@@ -8,7 +8,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = @{lib}/systemd/systemd-shutdown
-profile systemd-shutdown @{exec_path} flags=(complain) {
+profile systemd-shutdown @{exec_path} {
   include <abstractions/base>
   include <abstractions/systemd-common>
 
@@ -17,7 +17,8 @@ profile systemd-shutdown @{exec_path} flags=(complain) {
   capability sys_ptrace,
   capability sys_resource,
 
-  signal (send) set=(stop, cont, term, kill),
+  signal (send)    set=(stop, cont, term, kill),
+  signal (receive) set=(rtmin+23) peer=plymouthd,
 
   @{exec_path} mr,
 
@@ -29,5 +30,7 @@ profile systemd-shutdown @{exec_path} flags=(complain) {
   owner @{PROC}/sys/kernel/core_pattern w,
   owner @{PROC}/sys/kernel/printk rw,
 
+  /dev/watchdog@{int} w,
+
   include if exists <local/systemd-shutdown>
 }

apparmor.d/groups/ubuntu/software-properties-dbus

@@ -35,15 +35,19 @@ profile software-properties-dbus @{exec_path} {
 
   @{bin}/python3.[0-9]*  rix,
   @{bin}/env             rix,
+  @{bin}/apt-key         rPx,  # Changing trusted keys
   @{bin}/lsb_release     rPx -> lsb_release,
 
+  /etc/apt/apt.conf.d/10periodic w,
+  /etc/apt/sources.list{,.save} rw,
+
   /usr/share/python-apt/{,**} r,
   /usr/share/distro-info/*.csv r,
   /usr/share/xml/iso-codes/{,**} r,
 
-  owner /tmp/[a-z0-9]* rw,
+  owner /tmp/???????? rw,
-  owner /tmp/_[a-z0-9]* rw,
+  owner /tmp/tmp????????/ w, # change to 'c'
-  owner /tmp/tmp*/{,apt.conf} rw,
+  owner /tmp/tmp????????/apt.conf w,
 
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mounts r,

apparmor.d/groups/ubuntu/software-properties-gtk

@@ -40,6 +40,7 @@ profile software-properties-gtk @{exec_path} {
 
   @{bin}/ r,
 
+  @{bin}/python3.[0-9]*           r,
   @{bin}/{,da,ba}sh               rix,
   @{bin}/aplay                    rPx,
   @{bin}/apt-key                  rPx,
@@ -49,7 +50,6 @@ profile software-properties-gtk @{exec_path} {
   @{bin}/ubuntu-advantage         rPx,
 
   /usr/share/distro-info/*.csv r,
-  /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /usr/share/icons/{,**} r,
   /usr/share/mime/mime.cache r,
   /usr/share/pixmaps/ r,
@@ -59,6 +59,7 @@ profile software-properties-gtk @{exec_path} {
   /usr/share/ubuntu-drivers-common/detect/{,**} r,
   /usr/share/X11/xkb/{,**} r,
   /usr/share/xml/iso-codes/{,**} r,
+  /usr/share/software-properties/gtkbuilder/* r,
 
   /etc/apport/blacklist.d/{,*} r,
   /etc/default/apport r,
@@ -70,8 +71,11 @@ profile software-properties-gtk @{exec_path} {
   /var/lib/snapd/desktop/icons/ r,
   /var/lib/ubuntu-advantage/status.json r,
 
-  owner /tmp/[a-z0-9]* rw,
+  owner /tmp/???????? rw,
-  owner /tmp/tmp*/{,apt.conf} rw,
+  owner /tmp/tmp????????/ rw, # change to 'c'
+  owner /tmp/tmp????????/apt.conf rw,
+
+  owner @{run}/user/@{uid}/gnome-shell-disable-extensions w,
 
   @{sys}/devices/ r,
   @{sys}/devices/**/ r,

apparmor.d/profiles-a-f/adduser

@@ -16,6 +16,8 @@ profile adduser @{exec_path} {
   capability chown,
   capability dac_override,
   capability dac_read_search,
+  capability setuid,
+  capability setgid,
   capability fowner,
   capability fsetid,
 
@@ -40,6 +42,8 @@ profile adduser @{exec_path} {
   /etc/adduser.conf r,
   /etc/skel/{,.*} r,
 
+  @{run}/adduser wk,
+
   # To create user dirs and copy files from /etc/skel/ to them
   @{HOME}/ rw,
   @{HOME}/.* w,

apparmor.d/profiles-a-f/augenrules

@@ -18,8 +18,8 @@ profile augenrules @{exec_path} {
   @{bin}/chmod     rix,
   @{bin}/cmp       rix,
   @{bin}/cp        rix,
-  @{bin}/gawk      rix,
+  @{bin}/{,g,m}awk rix,
-  @{bin}/grep      rix,
+  @{bin}/{,e,f}grep rix,
   @{bin}/ls        rix,
   @{bin}/mktemp    rix,
   @{bin}/rm        rix,
@@ -27,7 +27,7 @@ profile augenrules @{exec_path} {
   /etc/audit/audit.rules rw,
   /etc/audit/rules.d/{,*} r,
 
-  owner /tmp/aurules.* rw,
+  owner /tmp/aurules.@{rand8} rw,
 
   /dev/tty rw,
 

apparmor.d/profiles-a-f/chpasswd

@@ -0,0 +1,34 @@
+# apparmor.d - Full set of apparmor profiles
+# SPDX-License-Identifier: GPL-2.0-only
+
+include <tunables/global>
+
+@{exec_path} = @{bin}/chpasswd
+profile chpasswd @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+  include <abstractions/nameservice-strict>
+
+  capability chown,
+  capability fsetid,
+  capability setuid,
+
+  signal (receive) set=(term, kill) peer=gnome-control-center,
+
+  @{exec_path} mr,
+
+  /etc/.pwd.lock wk,
+  /etc/login.defs r,
+  /etc/shadow rw,
+  /etc/shadow.@{int} w,
+  /etc/shadow.lock w,  # change to 'd'
+  /etc/shadow.lock l -> /etc/shadow.@{int},
+  /etc/shadow- w,
+  /etc/shadow+ rw,
+  /etc/passwd rw,
+  /etc/passwd.@{int} w,
+  /etc/passwd.lock w,  # change to 'd'
+  /etc/passwd.lock l -> /etc/passwd.@{int},
+
+  include if exists <local/chpasswd>
+}

apparmor.d/profiles-a-f/cups-browsed

@@ -65,5 +65,7 @@ profile cups-browsed @{exec_path} {
 
   @{run}/cups/certs/* r,
 
+  @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
+
   include if exists <local/cups-browsed>
 }

apparmor.d/profiles-g-l/ifup

@@ -56,6 +56,7 @@ profile ifup @{exec_path} {
 
     /etc/network/if-down.d/ r,
     /etc/network/if-down.d/resolvconf          rPUx,
+    /etc/network/if-down.d/resolved            rPUx,
     /etc/network/if-down.d/openvpn             rPUx,
     /etc/network/if-down.d/wpasupplicant       rPUx,
     /etc/wpa_supplicant/ifupdown.sh            rPUx,
@@ -84,6 +85,7 @@ profile ifup @{exec_path} {
 
     /etc/network/if-up.d/ r,
     /etc/network/if-up.d/*resolvconf           rPUx,
+    /etc/network/if-up.d/resolved	       rPUx,
     /etc/network/if-up.d/chrony                rPUx,
     /etc/network/if-up.d/ethtool               rPUx,
     /etc/network/if-up.d/ifenslave             rPUx,

apparmor.d/profiles-m-r/packagekitd

@@ -120,6 +120,9 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
   /usr/** rwlk -> /usr/**,
   /var/** rwlk -> /var/**,
 
+        /tmp/apt-changelog-@{rand6}/ w,
+        /tmp/apt-changelog-@{rand6}/*.changelog rw,
+  owner /tmp/apt-changelog-@{rand6}/.apt-acquire-privs-test.@{rand6} rw,
   owner /tmp/packagekit* rw,
 
         @{run}/systemd/inhibit/*.ref rw,
@@ -137,7 +140,7 @@ profile packagekitd @{exec_path} flags=(attach_disconnected) {
         @{PROC}/@{pids}/cgroup r,
         @{PROC}/@{pids}/mountinfo r,
         @{PROC}/sys/kernel/random/uuid r,
-  owner @{PROC}/@{pid}/cmdline r,
+        @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mounts r,
 

apparmor.d/profiles-s-z/wireplumber

@@ -58,6 +58,8 @@ profile wireplumber @{exec_path} {
   @{sys}/devices/pci[0-9]*/**/modalias r,
   @{sys}/devices/pci[0-9]*/**/video4linux/video[0-9]*/uevent r,
   @{sys}/devices/virtual/dmi/id/bios_vendor r,
+  @{sys}/devices/virtual/dmi/id/product_name r,
+  @{sys}/devices/virtual/dmi/id/sys_vendor r,
 
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,