update apparmor profiles

Co-authored-by: Mikhail Morfikov <mmorfikov@gmail.com>
Signed-off-by: Alexandre Pujol <alexandre@pujol.io>

apparmor.d/abstractions/chromium-common

@@ -0,0 +1,41 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+  abi <abi/3.0>,
+
+  # The following rules are needed only when the kernel.unprivileged_userns_clone option is set
+  # to "1".
+  capability sys_admin,
+  capability sys_chroot,
+  capability setuid,
+  capability setgid,
+  owner @{PROC}/@{pid}/setgroups w,
+  owner @{PROC}/@{pid}/gid_map w,
+  owner @{PROC}/@{pid}/uid_map w,
+
+        /var/tmp/ r,
+        /tmp/ r,
+  owner /tmp/.org.chromium.Chromium.*/ rw,
+  owner /tmp/.org.chromium.Chromium.*/SingletonCookie w,
+  owner /tmp/.org.chromium.Chromium.*/SingletonSocket w,
+  owner /tmp/.org.chromium.Chromium.*/SS w,
+  owner /tmp/.org.chromium.Chromium.* rw,
+  owner /tmp/scoped_dir*/ rw,
+  owner /tmp/scoped_dir*/SingletonCookie w,
+  owner /tmp/scoped_dir*/SingletonSocket w,
+  owner /tmp/scoped_dir*/SS w,
+
+        /dev/shm/ r,
+  owner /dev/shm/.org.chromium.Chromium.* rw,
+
+  owner @{HOME}/.local/share/.org.chromium.Chromium.* rw,
+
+  # Should this be read-only? (##FIXME##)
+  # To remove the following error:
+  #  Error initializing NSS with a persistent database
+  owner @{HOME}/.pki/ rw,
+  owner @{HOME}/.pki/nssdb/ rw,
+  owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
+  owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
+  owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,

apparmor.d/abstractions/deny-dconf

@@ -1,23 +0,0 @@
-# apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2019-2021 Mikhail Morfikov
-# SPDX-License-Identifier: GPL-2.0-only
-
-  abi <abi/3.0>,
-
-  deny /etc/dconf/{,**} r,
-
-  # When this is blocked, expect lots of the following errors:
-  #  dconf-CRITICAL **: unable to create file '/run/user/1000/dconf/user': Permission denied.
-  #  dconf will not work properly.
-  deny owner @{run}/user/@{uid}/dconf/{,**} rw,
-
-  deny owner @{user_config_dirs}/dconf/{,**} rw,
-  deny owner @{user_cache_dirs}/dconf/{,**} rw,
-
-  # When GSETTINGS_BACKEND=keyfile
-  deny owner @{user_config_dirs}/glib-2.0/ rw,
-  deny owner @{user_config_dirs}/glib-2.0/settings/ rw,
-  deny owner @{user_config_dirs}/glib-2.0/settings/keyfile rw,
-  deny owner @{user_config_dirs}/glib-2.0/settings/.goutputstream-* rw,
-
-  include if exists <abstractions/deny-dconf.d>

apparmor.d/abstractions/deny-root-dir-access

@@ -1,18 +0,0 @@
-# apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2020-2021 Mikhail Morfikov
-# SPDX-License-Identifier: GPL-2.0-only
-
-  # The goal of this abstraction is preventing apps (GUI) to be run as the root user by restraining
-  # access to the /root/ dir and its subdirectories. If you don't want to start an app as the super
-  # user (possibly by mistake), just include this abstraction in the app's AppArmor profile.
-  #
-  # Note that some apps will work anyway when run as root even if all of the files in the /root/
-  # are denied. Anyway, most of the apps refuse to start when they don't get the access to the
-  # needed files in the user home dir.
-
-  abi <abi/3.0>,
-
-  # Use audit for now to see whether some apps are trying to get access to the /root/ dir.
-  audit deny /root/{,**} rwkmlx,
-
-  include if exists <abstractions/deny-root-dir-access.d>

apparmor.d/abstractions/gtk

@@ -7,8 +7,10 @@
 
   /usr/share/themes/{,**} r,
 
-  /usr/share/gtksourceview-[0-9]*/ r,
+  /usr/share/gtksourceview-[0-9]*/{,**} r,
-  /usr/share/gtksourceview-[0-9]*/** r,
+
+  /usr/share/gtk-2.0/ r,
+  /usr/share/gtk-2.0/gtkrc r,
 
   /usr/share/gtk-{3,4}.0/ r,
   /usr/share/gtk-{3,4}.0/settings.ini r,
@@ -20,6 +22,9 @@
 
   /etc/gtk/gtkrc r,
 
+  owner @{HOME}/.themes/{,**} r,
+  owner @{HOME}/.local/share/themes/{,**} r,
+
   owner @{HOME}/.gtk r,
   owner @{HOME}/.gtkrc r,
   owner @{HOME}/.gtkrc-2.0 r,
@@ -43,4 +48,5 @@
   # Xsession errors file
   owner @{HOME}/.xsession-errors w,
 
-  include if exists <abstraction/gtk.d>
+  # Include additions to the abstraction
+  include if exists <abstractions/gtk.d>

apparmor.d/groups/apps/android-studio

@@ -27,15 +27,7 @@ profile android-studio @{exec_path} {
   include <abstractions/audio>
   include <abstractions/python>
   include <abstractions/devices-usb>
-  include <abstractions/deny-root-dir-access>
+  include <abstractions/chromium-common>
-
-  # The following rules are needed only when the kernel.unprivileged_userns_clone option is set
-  # to "1".
-  capability sys_admin,
-  capability sys_chroot,
-  owner @{PROC}/@{pid}/setgroups w,
-  owner @{PROC}/@{pid}/gid_map w,
-  owner @{PROC}/@{pid}/uid_map w,
 
   capability sys_ptrace,
 
@@ -174,12 +166,6 @@ profile android-studio @{exec_path} {
   owner @{HOME}/.java/.userPrefs/ rw,
   owner @{HOME}/.java/.userPrefs/** rwk,
 
-  owner @{HOME}/.pki/ rw,
-  owner @{HOME}/.pki/nssdb/ rw,
-  owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
-
   owner @{HOME}/.emulator_console_auth_token rw,
 
   deny owner @{HOME}/Desktop/* rw,
@@ -206,8 +192,6 @@ profile android-studio @{exec_path} {
 
   @{sys}/fs/cgroup/{,**} r,
 
-    /var/tmp/ r,
-        /tmp/ r,
   owner /tmp/** rwk,
   owner /tmp/native-platform[0-9]*dir/*.so rwm,
 
@@ -220,8 +204,6 @@ profile android-studio @{exec_path} {
   /var/lib/dbus/machine-id r,
   /etc/machine-id r,
 
-  owner /dev/shm/.org.chromium.Chromium.* rw,
-
   /dev/kvm rw,
 
   @{sys}/devices/virtual/block/**/rotational r,

apparmor.d/groups/apps/atom

@@ -16,6 +16,7 @@ profile atom @{exec_path} {
   include <abstractions/fontconfig-cache-read>
   include <abstractions/nameservice-strict>
   include <abstractions/enchant>
+  include <abstractions/chromium-common>
   # The following doesn't seem to be needed
   ##include <abstractions/mesa>
   ##include <abstractions/consoles>
@@ -24,8 +25,6 @@ profile atom @{exec_path} {
   include <abstractions/thumbnails-cache-read>
   ##include <abstractions/zsh>
   ##include <abstractions/fzf>
-  include <abstractions/deny-dconf>
-  include <abstractions/deny-root-dir-access>
 
   ptrace (read) peer=lsb_release,
   ptrace (read) peer=xdg-settings,
@@ -93,16 +92,12 @@ profile atom @{exec_path} {
 
   owner @{user_config_dirs}/git/config r,
 
-  # To remove the following error:
-  #  Error initializing NSS with a persistent database
-  deny owner @{HOME}/.pki/ rw,
-  deny owner @{HOME}/.pki/nssdb/ rw,
-  deny owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
-  deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
-  deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
-
   /etc/fstab r,
 
+  include <abstractions/dconf>
+  owner @{run}/user/@{uid}/dconf/ rw,
+  owner @{run}/user/@{uid}/dconf/user rw,
+
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
   # Needed or atom gets crash with the following error:
@@ -125,9 +120,6 @@ profile atom @{exec_path} {
        owner @{PROC}/@{pid}/mounts r,
   deny owner @{PROC}/@{pid}/loginuid r,
 
-  deny       /dev/shm/ r,
-       owner /dev/shm/.org.chromium.Chromium.* rw,
-
   /var/lib/dbus/machine-id r,
   /etc/machine-id r,
 
@@ -140,9 +132,6 @@ profile atom @{exec_path} {
   # The irq file is needed to render pages.
   deny @{sys}/devices/pci[0-9]*/**/irq r,
 
-        /var/tmp/ r,
-        /tmp/ r,
-  owner /tmp/.org.chromium.Chromium.* rw,
   owner /tmp/atom-[0-9a-f]*.sock rw,
   owner "/tmp/Atom Crashes/" rw,
   owner /tmp/github-[0-9]*-[0-9]*-*.*/ rw,
@@ -154,9 +143,6 @@ profile atom @{exec_path} {
   owner /tmp/apm-install-dir-[0-9]*-[0-9]*-*.*/** rw,
   owner /tmp/net-export/ rw,
 
-  # file_inherit
-  owner @{HOME}/.xsession-errors w,
-
   # Allowed apps to open
   /{usr/,}lib/firefox/firefox rPUx,
 

apparmor.d/groups/apps/calibre

@@ -41,15 +41,7 @@ profile calibre @{exec_path} {
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
   include <abstractions/devices-usb>
-  include <abstractions/deny-root-dir-access>
+  include <abstractions/chromium-common>
-
-  # The following rules are needed only when the kernel.unprivileged_userns_clone option is set
-  # to "1".
-  capability sys_admin,
-  capability sys_chroot,
-  owner @{PROC}/@{pid}/setgroups w,
-  owner @{PROC}/@{pid}/gid_map w,
-  owner @{PROC}/@{pid}/uid_map w,
 
   capability sys_ptrace,
 
@@ -142,9 +134,7 @@ profile calibre @{exec_path} {
 
   @{sys}/devices/pci[0-9]*/**/irq r,
 
-        /dev/shm/ r,
+  /dev/shm/#[0-9]*[0-9] rw,
-        /dev/shm/#[0-9]*[0-9] rw,
-  owner /dev/shm/.org.chromium.Chromium.* rw,
 
   /var/lib/dbus/machine-id r,
   /etc/machine-id r,
@@ -157,7 +147,6 @@ profile calibre @{exec_path} {
 
   # file_inherit
   owner /dev/tty[0-9]* rw,
-  owner @{HOME}/.xsession-errors w,
 
 
   profile open {

apparmor.d/groups/apps/code

@@ -16,14 +16,13 @@ profile code @{exec_path} {
   include <abstractions/fontconfig-cache-read>
   include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
+  include <abstractions/chromium-common>
   # The following doesn't seem to be needed
   ##include <abstractions/mesa>
   ##include <abstractions/consoles>
   ##include <abstractions/audio>
   ##include <abstractions/user-download-strict>
   include <abstractions/thumbnails-cache-read>
-  include <abstractions/deny-dconf>
-  include <abstractions/deny-root-dir-access>
 
   ptrace (read) peer=lsb_release,
 
@@ -70,16 +69,12 @@ profile code @{exec_path} {
   owner @{MOUNTS}/*/code/ r,
   owner @{MOUNTS}/*/code/** rwkl -> @{MOUNTS}/*/code/**,
 
-  # To remove the following error:
-  #  Error initializing NSS with a persistent database
-  deny owner @{HOME}/.pki/ rw,
-  deny owner @{HOME}/.pki/nssdb/ rw,
-  deny owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
-  deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
-  deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
-
   /etc/fstab r,
 
+  include <abstractions/dconf>
+  owner @{run}/user/@{uid}/dconf/ rw,
+  owner @{run}/user/@{uid}/dconf/user rw,
+
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
   # Needed or code gets crash with the following error:
@@ -106,9 +101,6 @@ profile code @{exec_path} {
   deny owner @{PROC}/@{pid}/net/if_inet6 r,
   deny owner @{PROC}/@{pids}/cmdline r,
 
-  deny       /dev/shm/ r,
-       owner /dev/shm/.org.chromium.Chromium.* rw,
-
   /var/lib/dbus/machine-id r,
   /etc/machine-id r,
 
@@ -120,8 +112,6 @@ profile code @{exec_path} {
   # The irq file is needed to render pages.
   deny @{sys}/devices/pci[0-9]*/**/irq r,
 
-        /var/tmp/ r,
-        /tmp/ r,
   owner "/tmp/VSCode Crashes/" rw,
   owner /tmp/vscode-typescript[0-9]*/ rw,
 
@@ -132,9 +122,5 @@ profile code @{exec_path} {
   # For installing extensions
   owner /tmp/@{uuid} rw,
 
-  # file_inherit
-  owner @{HOME}/.xsession-errors w,
-
   include if exists <local/code>
 }
-

apparmor.d/groups/apps/discord

@@ -6,11 +6,13 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-@{DISCORD_LIBDIR} = /usr/share/discord
+@{DISCORD_LIBDIR}   = /usr/share/discord
-@{DISCORD_HOMEDIR} = @{user_config_dirs}/discord
+@{DISCORD_LIBDIR}  += /usr/share/discord-ptb
-@{DISCORD_CACHEDIR} = @{user_cache_dirs}/discord
+@{DISCORD_HOMEDIR}  = @{HOME}/.config/discord
+@{DISCORD_HOMEDIR} += @{HOME}/.config/discordptb
+@{DISCORD_CACHEDIR} = @{HOME}/.cache/discord
 
-@{exec_path} = @{DISCORD_LIBDIR}/Discord /{usr/,}bin/discord
+@{exec_path} = @{DISCORD_LIBDIR}/Discord{,PTB} /{usr/,}bin/discord{,-ptb}
 profile discord @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
@@ -24,7 +26,7 @@ profile discord @{exec_path} {
   include <abstractions/mesa>
   include <abstractions/user-download-strict>
   include <abstractions/thumbnails-cache-read>
-  include <abstractions/deny-root-dir-access>
+  include <abstractions/chromium-common>
 
   signal (send) set=(kill, term) peer=@{profile_name}//lsb_release,
 
@@ -40,14 +42,6 @@ profile discord @{exec_path} {
 
   @{exec_path} mrix,
 
-  # The following rules are needed only when the kernel.unprivileged_userns_clone option is set
-  # to "1".
-  capability sys_admin,
-  capability sys_chroot,
-  owner @{PROC}/@{pid}/setgroups w,
-  owner @{PROC}/@{pid}/gid_map w,
-  owner @{PROC}/@{pid}/uid_map w,
-
   /{usr/,}bin/{,ba,da}sh   rix,
 
   /{usr/,}bin/xdg-open     rCx -> open,
@@ -59,11 +53,8 @@ profile discord @{exec_path} {
     @{DISCORD_LIBDIR}/ r,
     @{DISCORD_LIBDIR}/** r,
   # @{DISCORD_LIBDIR}/**.so mr,
-  # @{DISCORD_LIBDIR}/libEGL.so mr,
+    @{DISCORD_LIBDIR}/libEGL.so mr,
-  # @{DISCORD_LIBDIR}/libGLESv2.so mr,
+    @{DISCORD_LIBDIR}/libGLESv2.so mr,
-  # To remove the following error:
-  #  discord-canary: error while loading shared libraries: libffmpeg.so: cannot open shared object
-  #  file: No such file or directory
     @{DISCORD_LIBDIR}/libffmpeg.so mr,
   # @{DISCORD_LIBDIR}/swiftshader/libEGL.so mr,
   # @{DISCORD_LIBDIR}/swiftshader/libGLESv2.so mr,
@@ -85,7 +76,11 @@ profile discord @{exec_path} {
        owner @{PROC}/@{pids}/task/ r,
              @{PROC}/@{pids}/task/@{tid}/status r,
   deny       @{PROC}/@{pids}/stat r,
-  deny owner @{PROC}/@{pids}/statm r,
+  # Needed to remove the following error:
+  #  Error occurred in handler for 'DISCORD_PROCESS_UTILS_GET_MEMORY_INFO': [Error: Failed to
+  #  create memory dump]
+       owner @{PROC}/@{pids}/statm r,
+  #
   deny       @{PROC}/@{pids}/cmdline r,
              @{PROC}/sys/kernel/yama/ptrace_scope r,
              @{PROC}/sys/fs/inotify/max_user_watches r,
@@ -106,25 +101,11 @@ profile discord @{exec_path} {
   @{sys}/devices/pci[0-9]*/**/irq r,
 
   deny       /dev/ r,
-  deny       /dev/shm/ rw,
-       owner /dev/shm/.org.chromium.Chromium.* rw,
 
-        /var/tmp/ r,
-        /tmp/ r,
   owner /tmp/net-export/ rw,
   owner /tmp/discord.sock rw,
-  owner /tmp/.org.chromium.Chromium.*/ rw,
-  owner /tmp/.org.chromium.Chromium.*/discord1_[0-9]*.png rw,
-  owner /tmp/.org.chromium.Chromium.*/SingletonCookie rw,
-  owner /tmp/.org.chromium.Chromium.*/SS rw,
   owner "/tmp/Discord Crashes/" rw,
 
-  owner @{HOME}/.pki/ rw,
-  owner @{HOME}/.pki/nssdb/ rw,
-  owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
-
   owner @{run}/user/@{uid}/discord-ipc-[0-9] rw,
 
   /var/lib/dbus/machine-id r,

apparmor.d/groups/apps/discord-chrome-sandbox

@@ -14,7 +14,6 @@ include <tunables/global>
 
 profile discord-chrome-sandbox @{exec_path} {
   include <abstractions/base>
-  include <abstractions/deny-root-dir-access>
 
   # For kernel unprivileged user namespaces
   capability sys_admin,

apparmor.d/groups/apps/dropbox

@@ -23,7 +23,6 @@ profile dropbox @{exec_path} {
   include <abstractions/qt5-settings-write>
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>
 
   ptrace peer=@{profile_name},
 

apparmor.d/groups/apps/filezilla

@@ -15,7 +15,6 @@ profile filezilla @{exec_path} {
   include <abstractions/freedesktop.org>
   include <abstractions/nameservice>
   include <abstractions/user-download-strict>
-  include <abstractions/deny-root-dir-access>
 
   signal (send) set=(term, kill) peer=fzsftp,
 

apparmor.d/groups/apps/flameshot

@@ -23,7 +23,6 @@ profile flameshot @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>
 
   network inet dgram,
   network inet6 dgram,
@@ -68,7 +67,6 @@ profile flameshot @{exec_path} {
 
   # file_inherit
   owner /dev/tty[0-9]* rw,
-  owner @{HOME}/.xsession-errors w,
 
 
   profile open {

apparmor.d/groups/apps/freetube

@@ -25,16 +25,7 @@ profile freetube @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/user-download-strict>
   include <abstractions/thumbnails-cache-read>
-  include <abstractions/deny-dconf>
+  include <abstractions/chromium-common>
-  include <abstractions/deny-root-dir-access>
-
-  # The following rules are needed only when the kernel.unprivileged_userns_clone option is set
-  # to "1".
-  capability sys_admin,
-  capability sys_chroot,
-  owner @{PROC}/@{pid}/setgroups w,
-  owner @{PROC}/@{pid}/gid_map w,
-  owner @{PROC}/@{pid}/uid_map w,
 
   network inet dgram,
   network inet6 dgram,
@@ -55,17 +46,6 @@ profile freetube @{exec_path} {
   owner @{user_config_dirs}/FreeTube/ rw,
   owner @{user_config_dirs}/FreeTube/** rwk,
 
-        /var/tmp/ r,
-        /tmp/ r,
-  owner /tmp/.org.chromium.Chromium.*/ rw,
-  owner /tmp/.org.chromium.Chromium.*/SingletonCookie w,
-  owner /tmp/.org.chromium.Chromium.*/SS w,
-  owner /tmp/.org.chromium.Chromium.* rw,
-  owner /tmp/net-export/ rw,
-
-        /dev/shm/ r,
-  owner /dev/shm/.org.chromium.Chromium.* rw,
-
   # The /proc/ dir is needed to avoid the following error:
   #   traps: freetube[] trap int3 ip:56499eca9d26 sp:7ffcab073060 error:0 in
   #          freetube[56499b8a8000+531e000]
@@ -84,8 +64,13 @@ profile freetube @{exec_path} {
              @{PROC}/sys/kernel/yama/ptrace_scope r,
   deny       @{PROC}/vmstat r,
              @{PROC}/sys/fs/inotify/max_user_watches r,
+
   /etc/fstab r,
 
+  include <abstractions/dconf>
+  owner @{run}/user/@{uid}/dconf/ rw,
+  owner @{run}/user/@{uid}/dconf/user rw,
+
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
   owner @{user_share_dirs} r,
@@ -97,10 +82,6 @@ profile freetube @{exec_path} {
   # The irq file is needed to render pages.
   deny @{sys}/devices/pci[0-9]*/**/irq r,
 
-  # Needed?
-  deny owner @{HOME}/.pki/ rw,
-  deny owner @{HOME}/.pki/** rwk,
-
   /var/lib/dbus/machine-id r,
   /etc/machine-id r,
 

apparmor.d/groups/apps/freetube-chrome-sandbox

@@ -15,7 +15,6 @@ include <tunables/global>
 profile freetube-chrome-sandbox @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
-  include <abstractions/deny-root-dir-access>
 
   capability sys_admin,
   capability setgid,

apparmor.d/groups/apps/okular

@@ -25,7 +25,6 @@ profile okular @{exec_path} {
   include <abstractions/kde-icon-cache-write>
   include <abstractions/qt5-settings-write>
   include <abstractions/qt5-compose-cache-write>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} mr,
 

apparmor.d/groups/apps/signal-desktop

@@ -22,19 +22,11 @@ profile signal-desktop @{exec_path} {
   include <abstractions/mesa>
   include <abstractions/nameservice-strict>
   include <abstractions/user-download-strict>
-  include <abstractions/deny-root-dir-access>
+  include <abstractions/chromium-common>
 
   # Needed?
   deny capability sys_ptrace,
 
-  # The following rules are needed only when the kernel.unprivileged_userns_clone option is set
-  # to "1".
-  capability sys_admin,
-  capability sys_chroot,
-  owner @{PROC}/@{pid}/setgroups w,
-  owner @{PROC}/@{pid}/gid_map w,
-  owner @{PROC}/@{pid}/uid_map w,
-
   network inet dgram,
   network inet6 dgram,
   network inet stream,
@@ -59,18 +51,8 @@ profile signal-desktop @{exec_path} {
   @{SIGNAL_HOMEDIR}/ rw,
   @{SIGNAL_HOMEDIR}/** rwk,
 
-  #owner @{HOME}/.pki/nssdb/pkcs11.txt r,
-  #owner @{HOME}/.pki/nssdb/cert9.db rwk,
-  #owner @{HOME}/.pki/nssdb/key4.db rwk,
-
   # Signal wants the /tmp/ dir to be mounted with the "exec" flag. If this is not acceptable in
   # your system, use the TMPDIR variable to set some other tmp dir.
-  /tmp/ r,
-  owner /tmp/.org.chromium.Chromium.*/ rw,
-  owner /tmp/.org.chromium.Chromium.*/SingletonCookie w,
-  owner /tmp/.org.chromium.Chromium.*/SS w,
-  owner /tmp/.org.chromium.Chromium.* rw,
-  /var/tmp/ r,
   owner @{SIGNAL_HOMEDIR}/tmp/.org.chromium.Chromium.* mrw,
 
   @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
@@ -90,9 +72,6 @@ profile signal-desktop @{exec_path} {
              @{PROC}/sys/fs/inotify/max_user_watches r,
              @{PROC}/vmstat r,
 
-  deny /dev/shm/ r,
-       /dev/shm/.org.chromium.Chromium.* rw,
-
   /var/lib/dbus/machine-id r,
   /etc/machine-id r,
 

apparmor.d/groups/apps/signal-desktop-chrome-sandbox

@@ -13,7 +13,6 @@ include <tunables/global>
 @{exec_path} = "/opt/Signal{, Beta}/chrome-sandbox"
 profile signal-desktop-chrome-sandbox @{exec_path} {
   include <abstractions/base>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} mr,
 

apparmor.d/groups/apps/spotify

@@ -21,7 +21,7 @@ profile spotify @{exec_path} {
   include <abstractions/thumbnails-cache-read>
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>
+  include <abstractions/chromium-common>
 
   @{exec_path} mrix,
 
@@ -57,8 +57,6 @@ profile spotify @{exec_path} {
 
   /etc/fstab r,
 
-  owner /dev/shm/.org.chromium.Chromium.* rw,
-
   deny @{sys}/devices/virtual/tty/tty[0-9]*/active r,
   # To remove the following error:
   #  pcilib: Cannot open /sys/bus/pci/devices/0000:03:00.0/irq: Permission denied
@@ -69,19 +67,10 @@ profile spotify @{exec_path} {
 
   /usr/share/X11/XErrorDB r,
 
-        /tmp/ r,
   owner /tmp/[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw,
 
   # What's this for?
   #owner /tmp/[0-9]*.[0-9]*.[0-9]*.[0-9]*-linux-*.zip rw,
 
-  /var/tmp/ r,
-
-  deny owner @{HOME}/.pki/ rw,
-  deny owner @{HOME}/.pki/nssdb/ rw,
-  deny owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
-  deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
-  deny owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
-
   include if exists <local/spotify>
 }

apparmor.d/groups/apps/telegram-desktop

@@ -27,8 +27,6 @@ profile telegram-desktop @{exec_path} {
   include <abstractions/enchant>
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
-  include <abstractions/deny-dconf>
-  include <abstractions/deny-root-dir-access>
 
   network inet dgram,
   network inet6 dgram,
@@ -76,6 +74,10 @@ profile telegram-desktop @{exec_path} {
   /var/lib/dbus/machine-id r,
   /etc/machine-id r,
 
+  include <abstractions/dconf>
+  owner @{run}/user/@{uid}/dconf/ rw,
+  owner @{run}/user/@{uid}/dconf/user rw,
+
   # Needed when saving files as, or otherwise the app crashes
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 

apparmor.d/groups/apps/thunderbird

@@ -30,8 +30,6 @@ profile thunderbird @{exec_path} {
   include <abstractions/mesa>
   include <abstractions/nameservice-strict>
   include <abstractions/openssl>
-  include <abstractions/deny-dconf>
-  include <abstractions/deny-root-dir-access>
 
   ptrace peer=@{profile_name},
 
@@ -93,6 +91,10 @@ profile thunderbird @{exec_path} {
   owner @{HOME}/Mail/ rw,
   owner @{HOME}/Mail/** rwl -> @{HOME}/Mail/**,
 
+  include <abstractions/dconf>
+  owner @{run}/user/@{uid}/dconf/ rw,
+  owner @{run}/user/@{uid}/dconf/user rw,
+
   # Fix error in libglib while saving files as
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
@@ -187,7 +189,6 @@ profile thunderbird @{exec_path} {
 
   # file_inherit
   owner /dev/tty[0-9]* rw,
-  owner @{HOME}/.xsession-errors w,
 
 
   profile gpg {

apparmor.d/groups/apps/usr.lib.libreoffice.program.soffice.bin

@@ -108,7 +108,7 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
   owner @{libo_user_dirs}/**/           rw,  #allow creating directories that we own
   owner @{libo_user_dirs}/**~lock.*     rw,  #lock file support
   owner @{libo_user_dirs}/**.@{libreoffice_ext} rwk,  #Open files rw with the right exts
-  owner @{libo_user_dirs}/{,**/}lu???????????{,?}.tmp rwk, #Temporary file used when saving
+  owner @{libo_user_dirs}/{,**/}lu????????{,?,??,???,????}.tmp rwk, #Temporary file used when saving
   owner @{libo_user_dirs}/{,**/}.directory r, #Read directory settings on KDE
 
   # Settings

apparmor.d/groups/apps/vlc

@@ -70,7 +70,6 @@ profile vlc @{exec_path} {
   include <abstractions/private-files-strict>
   include <abstractions/ssl_certs>
   include <abstractions/devices-usb>
-  include <abstractions/deny-root-dir-access>
 
   signal (receive) set=(term, kill) peer=anyremote//*,
 

apparmor.d/groups/apt/apt-listbugs

@@ -23,21 +23,25 @@ profile apt-listbugs @{exec_path} {
   network netlink raw,
 
   @{exec_path} r,
-  /{usr/,}bin/ruby2.[0-9]* rix,
+  /{usr/,}bin/ruby[0-9].[0-9]* rix,
 
-  /{usr/,}bin/{,ba,da}sh   rix,
+  /{usr/,}bin/{,ba,da}sh       rix,
-  /{usr/,}bin/logname      rix,
+  /{usr/,}bin/logname          rix,
 
-  /{usr/,}bin/apt-config   rPx,
+  /{usr/,}bin/apt-config       rPx,
   # Do not strip env to avoid errors like the following:
   #  ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open
   #  shared object file): ignored.
-  /{usr/,}bin/dpkg-query   rpx,
+  /{usr/,}bin/dpkg-query       rpx,
 
   /usr/local/lib/site_ruby/[0-9].[0-9].[0-9]/**.rb r,
 
   /usr/share/rubygems-integration/*/specifications/ r,
-  /usr/share/rubygems-integration/*/specifications/* r,
+  /usr/share/rubygems-integration/*/specifications/*.gemspec rwk,
+
+  /{usr/,}lib/ruby/gems/*/specifications/ r,
+  /{usr/,}lib/ruby/gems/*/specifications/** r,
+  /{usr/,}lib/ruby/gems/*/specifications/**.gemspec rwk,
 
   /etc/apt/listbugs/{,*} r,
 

apparmor.d/groups/apt/apt-listbugs-migratepins

@@ -13,10 +13,14 @@ profile apt-listbugs-migratepins @{exec_path} {
   include <abstractions/ruby>
 
   @{exec_path} r,
-  /{usr/,}bin/ruby2.[0-9]* rix,
+  /{usr/,}bin/ruby[0-9].[0-9]* rix,
 
   /usr/share/rubygems-integration/*/specifications/ r,
-  /usr/share/rubygems-integration/*/specifications/* r,
+  /usr/share/rubygems-integration/*/specifications/*.gemspec rwk,
+
+  /{usr/,}lib/ruby/gems/*/specifications/ r,
+  /{usr/,}lib/ruby/gems/*/specifications/** r,
+  /{usr/,}lib/ruby/gems/*/specifications/**.gemspec rwk,
 
   /etc/apt/preferences r,
 

apparmor.d/groups/apt/apt-listbugs-prefclean

@@ -13,7 +13,7 @@ profile apt-listbugs-prefclean @{exec_path} {
   include <abstractions/ruby>
 
   @{exec_path} r,
-  /{usr/,}bin/ruby2.[0-9]* rix,
+  /{usr/,}bin/ruby[0-9].[0-9]* rix,
 
   /{usr/,}bin/date rix,
   /{usr/,}bin/cat rix,

apparmor.d/groups/apt/apt-listchanges

@@ -79,6 +79,7 @@ profile apt-listchanges @{exec_path} {
     include <abstractions/base>
     include <abstractions/consoles>
 
+    capability dac_read_search,
     #capability sys_tty_config,
 
     /{usr/,}bin/sensible-pager mr,

apparmor.d/groups/apt/querybts

@@ -18,7 +18,6 @@ profile querybts @{exec_path} {
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
   include <abstractions/apt-common>
-  include <abstractions/deny-root-dir-access>
 
   network inet dgram,
   network inet6 dgram,

apparmor.d/groups/apt/reportbug

@@ -19,8 +19,6 @@ profile reportbug @{exec_path} {
   include <abstractions/enchant>
   include <abstractions/python>
   include <abstractions/apt-common>
-  include <abstractions/deny-root-dir-access>
-  include <abstractions/deny-dconf>
 
   network inet dgram,
   network inet6 dgram,
@@ -65,6 +63,10 @@ profile reportbug @{exec_path} {
   /{usr/,}bin/run-parts        rCx -> run-parts,
   /{usr/,}bin/gpg              rCx -> gpg,
 
+  include <abstractions/dconf>
+  owner @{run}/user/@{uid}/dconf/ rw,
+  owner @{run}/user/@{uid}/dconf/user rw,
+
   # For sending additional information
   /etc/** r,
 

apparmor.d/groups/apt/synaptic

@@ -16,7 +16,6 @@ profile synaptic @{exec_path} {
   include <abstractions/freedesktop.org>
   include <abstractions/apt-common>
   include <abstractions/nameservice-strict>
-  include <abstractions/deny-dconf>
 
   # To remove the following errors:
   #  W: chmod 0700 of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory

apparmor.d/groups/browsers/brave

@@ -24,19 +24,10 @@ profile brave @{exec_path} {
   include <abstractions/user-download-strict>
   include <abstractions/nameservice-strict>
   include <abstractions/thumbnails-cache-read>
-  include <abstractions/deny-dconf>
+  include <abstractions/chromium-common>
-  include <abstractions/deny-root-dir-access>
 
   capability sys_ptrace,
 
-  # The following rules are needed only when the kernel.unprivileged_userns_clone option is set
-  # to "1".
-  capability sys_admin,
-  capability sys_chroot,
-  owner @{PROC}/@{pid}/setgroups w,
-  owner @{PROC}/@{pid}/gid_map w,
-  owner @{PROC}/@{pid}/uid_map w,
-
   ptrace (read),
 
   @{exec_path} mrix,
@@ -78,14 +69,6 @@ profile brave @{exec_path} {
 
   /usr/share/chromium/extensions/ r,
 
-  # To remove the following error:
-  #  Error initializing NSS with a persistent database
-  owner @{HOME}/.pki/ rw,
-  owner @{HOME}/.pki/nssdb/ rw,
-  owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
-
   owner @{HOME}/ r,
   owner @{user_config_dirs}/BraveSoftware/ w,
   owner @{BRAVE_HOMEDIR}/ rw,
@@ -122,6 +105,10 @@ profile brave @{exec_path} {
 
   /etc/fstab r,
 
+  include <abstractions/dconf>
+  owner @{run}/user/@{uid}/dconf/ rw,
+  owner @{run}/user/@{uid}/dconf/user rw,
+
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
   # Needed or Brave crash with the following error:
@@ -148,14 +135,10 @@ profile brave @{exec_path} {
              @{PROC}/sys/fs/inotify/max_user_watches r,
   deny       @{PROC}filesystems r,
 
-  owner /dev/shm/.org.chromium.Chromium.* rw,
   owner /dev/shm/org.chromium.Chromium.shmem.[A-F0-9]*._service_shmem rw,
 
   /dev/bus/usb/[0-9]*/[0-9]* rw,
 
-  # For downloading files
-  owner @{user_share_dirs}/.org.chromium.Chromium.* rw,
-
   /var/lib/dbus/machine-id r,
   /etc/machine-id r,
 
@@ -179,22 +162,12 @@ profile brave @{exec_path} {
 
   @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
 
-        /var/tmp/ r,
-        /tmp/ r,
-  owner /tmp/.org.chromium.Chromium.* rw,
-  owner /tmp/.org.chromium.Chromium.*/{,**} rw,
-  # For installing/updating/removing extensions
-  owner /tmp/scoped_dir*/{,**} rw,
-  owner /tmp/tmp.* rw,
   # For brave://net-export/
   owner /tmp/net-export/ rw,
 
   # Silencer
   deny @{BRAVE_INSTALLDIR}/** w,
 
-  # file_inherit
-  owner @{HOME}/.xsession-errors w,
-
 
   profile open {
     include <abstractions/base>

apparmor.d/groups/browsers/brave-browser

@@ -14,7 +14,6 @@ include <tunables/global>
 profile brave-browser @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} r,
   /{usr/,}bin/{,ba,da}sh    rix,

apparmor.d/groups/browsers/brave-sandbox

@@ -13,7 +13,6 @@ include <tunables/global>
 @{exec_path} = @{BRAVE_INSTALLDIR}/{brave,chrome}-sandbox
 profile brave-sandbox @{exec_path} {
   include <abstractions/base>
-  include <abstractions/deny-root-dir-access>
 
   # For kernel unprivileged user namespaces
   capability sys_admin,

apparmor.d/groups/browsers/chromium

@@ -14,7 +14,6 @@ include <tunables/global>
 profile chromium @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/freedesktop.org>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} r,
 

apparmor.d/groups/browsers/chromium-chrome-crashpad-handler

@@ -0,0 +1,36 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{CHROMIUM_INSTALLDIR} = /{usr/,}lib/chromium
+@{CHROMIUM_HOMEDIR} = @{HOME}/.config/chromium
+@{CHROMIUM_CACHEDIR} = @{HOME}/.cache/chromium
+
+@{exec_path} = @{CHROMIUM_INSTALLDIR}/chrome_crashpad_handler
+profile chromium-chrome-crashpad-handler @{exec_path} flags=(complain) {
+  include <abstractions/base>
+
+  capability sys_ptrace,
+
+  ptrace peer=chromium-chromium,
+  signal (send) peer=chromium-chromium,
+
+  @{exec_path} mrix,
+
+  owner "@{HOME}/.config/chromium/Crash Reports/**" rwk,
+
+  owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pids}/mem r,
+  owner @{PROC}/@{pids}/stat r,
+  owner @{PROC}/@{pids}/task/ r,
+        @{PROC}/sys/kernel/yama/ptrace_scope r,
+
+  @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_cur_freq r,
+  @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_max_freq r,
+
+  include if exists <local/chromium-chrome-crashpad-handler>
+}

apparmor.d/groups/browsers/chromium-chrome-sandbox

@@ -14,7 +14,6 @@ include <tunables/global>
 
 profile chromium-chrome-sandbox @{exec_path} {
   include <abstractions/base>
-  include <abstractions/deny-root-dir-access>
 
   # For kernel unprivileged user namespaces
   capability sys_admin,

apparmor.d/groups/browsers/chromium-chromium

@@ -28,7 +28,6 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
   include <abstractions/thumbnails-cache-read>
   include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>
 
   ptrace (read) peer=chrome-gnome-shell,
 
@@ -46,6 +45,7 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
   ptrace (read) peer=lsb_release,
 
   signal (send) set=(term, kill) peer=keepassxc-proxy,
+  signal (receive) peer=chromium-chrome-crashpad-handler,
 
   network inet dgram,
   network inet6 dgram,
@@ -55,9 +55,9 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mrix,
 
-  /{usr/,}bin/chrome-gnome-shell          rPx,
+  /{usr/,}bin/chrome-gnome-shell                  rPx,
-  @{CHROMIUM_INSTALLDIR}/chrome-sandbox   rPx,
+  @{CHROMIUM_INSTALLDIR}/chrome-sandbox           rPx,
-  @{CHROMIUM_INSTALLDIR}/crashpad_handler rPx,
+  @{CHROMIUM_INSTALLDIR}/chrome_crashpad_handler  rPx,
 
   # For storing passwords externally
   /{usr/,}bin/keepassxc-proxy   rPUx,
@@ -70,14 +70,6 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
   /{usr/,}bin/xdg-desktop-menu   rPx,
   /{usr/,}bin/xdg-icon-resource  rPx,
 
-  # To remove the following error:
-  #  Error initializing NSS with a persistent database
-  owner @{HOME}/.pki/ rw,
-  owner @{HOME}/.pki/nssdb/ rw,
-  owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
-
   # Chromium files
   /usr/share/chromium/{,**} r,
 
@@ -121,36 +113,39 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
 
   /etc/fstab r,
 
+  include <abstractions/dconf>
+  owner @{run}/user/@{uid}/dconf/ rw,
+  owner @{run}/user/@{uid}/dconf/user rw,
+
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
   # Needed or chromium gets crash with the following error:
   #  FATAL:sandbox_linux.cc(172)] Check failed: proc_fd_ >= 0 (-1 vs. 0)
              @{PROC}/ r,
   #
-  deny       @{PROC}/vmstat r,
+             @{PROC}/vmstat r,
              @{PROC}/sys/kernel/yama/ptrace_scope r,
              @{PROC}/@{pid}/fd/ r,
-  deny       @{PROC}/@{pids}/stat r,
+             @{PROC}/@{pids}/stat r,
-  deny       @{PROC}/@{pids}/statm r,
+             @{PROC}/@{pids}/statm r,
   # To remove the following error:
   #  Failed to adjust OOM score of renderer with pid : Permission denied
-  deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
+       owner @{PROC}/@{pid}/oom_{,score_}adj rw,
   #
   deny       @{PROC}/@{pids}/cmdline r,
-  deny owner @{PROC}/@{pids}/environ r,
+       owner @{PROC}/@{pids}/environ r,
        owner @{PROC}/@{pids}/task/ r,
-  deny       @{PROC}/@{pids}/task/@{tid}/stat r,
+             @{PROC}/@{pids}/task/@{tid}/stat r,
              @{PROC}/@{pids}/task/@{tid}/status r,
-  deny owner @{PROC}/@{pid}/limits r,
+       owner @{PROC}/@{pid}/limits r,
-  deny owner @{PROC}/@{pid}/mem r,
+       owner @{PROC}/@{pid}/mem r,
        owner @{PROC}/@{pid}/mountinfo r,
        owner @{PROC}/@{pid}/mounts r,
   # To remove the following error:
   #  file_path_watcher_linux.cc(71)] Failed to read /proc/sys/fs/inotify/max_user_watches
              @{PROC}/sys/fs/inotify/max_user_watches r,
-
+  #
-   deny /dev/shm/ r,
+       owner @{PROC}/@{pids}/clear_refs w,
-  owner /dev/shm/.org.chromium.Chromium.* rw,
 
   /var/lib/dbus/machine-id r,
   /etc/machine-id r,
@@ -174,19 +169,10 @@ profile chromium-chromium @{exec_path} flags=(attach_disconnected) {
   @{sys}/devices/virtual/dmi/id/product_name r,
   @{sys}/devices/virtual/dmi/id/sys_vendor r,
 
-        /var/tmp/ r,
-        /tmp/ r,
-  owner /tmp/.org.chromium.Chromium.* rw,
-  owner /tmp/.org.chromium.Chromium.*/{,**} rw,
-
   # For the temp profile
   owner /tmp/tmp.*/ rw,
   owner /tmp/tmp.*/** rwk,
 
-  # For installing/updating extensions
-  owner /tmp/scoped_dir*/ rw,
-  owner /tmp/scoped_dir*/** rw,
-
   # Silencer
   deny @{CHROMIUM_INSTALLDIR}/** w,
 

apparmor.d/groups/browsers/chromium-crashpad-handler

@@ -14,7 +14,6 @@ include <tunables/global>
 
 profile chromium-crashpad_handler @{exec_path} flags=(complain) {
   include <abstractions/base>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} mrix,
 

apparmor.d/groups/browsers/firefox

@@ -17,7 +17,6 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/audio>
   include <abstractions/dconf>
-  include <abstractions/deny-root-dir-access>
   include <abstractions/enchant>
   include <abstractions/fontconfig-cache-read>
   include <abstractions/fonts>

apparmor.d/groups/browsers/firefox-crashreporter

@@ -20,8 +20,6 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) {
   include <abstractions/fonts>
   include <abstractions/fontconfig-cache-read>
   include <abstractions/openssl>
-  include <abstractions/deny-root-dir-access>
-  include <abstractions/deny-dconf>
 
   signal (receive) set=(term, kill) peer=firefox,
 
@@ -55,6 +53,10 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) {
 
   owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* r,
 
+  include <abstractions/dconf>
+  owner @{run}/user/@{uid}/dconf/ rw,
+  owner @{run}/user/@{uid}/dconf/user rw,
+
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
   /usr/share/X11/xkb/** r,
@@ -62,8 +64,6 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) {
   # file_inherit
   owner @{MOZ_CACHEDIR}/firefox/*.*/** r,
   owner @{MOZ_HOMEDIR}/firefox/*.*/extensions/*.xpi r,
-  owner @{MOZ_HOMEDIR}/firefox/*.*/.parentlock rw,
-  owner @{HOME}/.xsession-errors w,
   /dev/dri/renderD128 rw,
   /dev/dri/card[0-9]* rw,
 

apparmor.d/groups/browsers/firefox-minidump-analyzer

@@ -13,7 +13,6 @@ include <tunables/global>
 @{exec_path} = /{usr/,}lib/firefox/minidump-analyzer
 profile firefox-minidump-analyzer @{exec_path} {
   include <abstractions/base>
-  include <abstractions/deny-root-dir-access>
 
   signal (receive) set=(term, kill) peer=firefox,
 

apparmor.d/groups/browsers/firefox-pingsender

@@ -16,7 +16,6 @@ profile firefox-pingsender @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>
 
   signal (receive) set=(term, kill) peer=firefox,
 

apparmor.d/groups/browsers/google-chrome-chrome

@@ -24,15 +24,7 @@ profile google-chrome-chrome @{exec_path} {
   include <abstractions/thumbnails-cache-read>
   include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>
+  include <abstractions/chromium-common>
-
-  # The following rules are needed only when the kernel.unprivileged_userns_clone option is set
-  # to "1".
-  capability sys_admin,
-  capability sys_chroot,
-  owner @{PROC}/@{pid}/setgroups w,
-  owner @{PROC}/@{pid}/gid_map w,
-  owner @{PROC}/@{pid}/uid_map w,
 
   ptrace (trace) peer=@{profile_name},
 
@@ -69,20 +61,10 @@ profile google-chrome-chrome @{exec_path} {
   /{usr/,}bin/xdg-mime          rPx,
   /{usr/,}bin/xdg-settings      rPx,
 
-  # To remove the following error:
-  #  Error initializing NSS with a persistent database
-  owner @{HOME}/.pki/ rw,
-  owner @{HOME}/.pki/nssdb/ rw,
-  owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
-
   # Google Chrome home files
   owner @{HOME}/ r,
   owner @{CHROME_HOMEDIR}/ rw,
   owner @{CHROME_HOMEDIR}/** rwk,
-  # Flashplayer
-  owner @{CHROME_HOMEDIR}/PepperFlash/**/libpepflashplayer.so mr,
 
   owner @{user_share_dirs}/.com.google.Chrome.* rw,
 
@@ -141,8 +123,6 @@ profile google-chrome-chrome @{exec_path} {
        owner @{PROC}/@{pid}/mounts r,
   deny       @{PROC}/diskstats r,
 
-  owner /dev/shm/.com.google.Chrome.* rw,
-
   # To play DRM media (protected content)
   @{CHROME_INSTALLDIR}/libwidevinecdm.so mr,
   @{CHROME_INSTALLDIR}/libwidevinecdmadapter.so mr,
@@ -168,13 +148,6 @@ profile google-chrome-chrome @{exec_path} {
   # The irq file is needed to render pages.
   @{sys}/devices/pci[0-9]*/**/irq r,
 
-        /var/tmp/ r,
-        /tmp/ r,
-  owner /tmp/.com.google.Chrome.* rw,
-  owner /tmp/.com.google.Chrome.*/{,**} rw,
-  # For installing/updating extensions
-  owner /tmp/scoped_dir*/{,**} rw,
-
   # Silencer
   deny @{CHROME_INSTALLDIR}/** w,
 

apparmor.d/groups/browsers/google-chrome-chrome-sandbox

@@ -13,7 +13,6 @@ include <tunables/global>
 @{exec_path} = @{CHROME_INSTALLDIR}/chrome-sandbox
 profile google-chrome-chrome-sandbox @{exec_path} {
   include <abstractions/base>
-  include <abstractions/deny-root-dir-access>
 
   # For kernel unprivileged user namespaces
   capability sys_admin,

apparmor.d/groups/browsers/google-chrome-google-chrome

@@ -14,7 +14,6 @@ include <tunables/global>
 profile google-chrome-google-chrome @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} r,
   /{usr/,}bin/{,ba,da}sh rix,

apparmor.d/groups/browsers/opera

@@ -25,16 +25,7 @@ profile opera @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
-  include <abstractions/deny-dconf>
+  include <abstractions/chromium-common>
-  include <abstractions/deny-root-dir-access>
-
-  # The following rules are needed only when the kernel.unprivileged_userns_clone option is set
-  # to "1".
-  capability sys_admin,
-  capability sys_chroot,
-  owner @{PROC}/@{pid}/setgroups w,
-  owner @{PROC}/@{pid}/gid_map w,
-  owner @{PROC}/@{pid}/uid_map w,
 
   ptrace (trace) peer=@{profile_name},
 
@@ -62,21 +53,11 @@ profile opera @{exec_path} {
   /{usr/,}bin/xdg-desktop-menu   rPx,
   /{usr/,}bin/xdg-icon-resource  rPx,
 
-  # To remove the following error:
-  #  Error initializing NSS with a persistent database
-  owner @{HOME}/.pki/ rw,
-  owner @{HOME}/.pki/nssdb/ rw,
-  owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
-
   # Opera home files
   owner @{HOME}/ r,
   owner @{OPERA_HOMEDIR}/ rw,
   owner @{OPERA_HOMEDIR}/** rwk,
 
-  owner @{user_share_dirs}/.org.chromium.Chromium.* rw,
-
   # Cache files
   owner @{user_cache_dirs}/ rw,
   owner @{OPERA_CACHEDIR}/{,**/} rw,
@@ -100,13 +81,12 @@ profile opera @{exec_path} {
   owner @{user_config_dirs}/chromium/*/ r,
   owner @{user_config_dirs}/chromium/*/{History,Cookies,Favicons,Bookmarks} rwk,
 
-  # Flashplayer
-  owner @{user_config_dirs}/google-chrome{,-beta,-unstable}/PepperFlash/**/manifest.json r,
-  owner @{user_config_dirs}/google-chrome{,-beta,-unstable}/PepperFlash/latest-component-updated-flash r,
-  owner @{user_config_dirs}/google-chrome{,-beta,-unstable}/PepperFlash/**/libpepflashplayer.so mr,
-
   /etc/fstab r,
 
+  include <abstractions/dconf>
+  owner @{run}/user/@{uid}/dconf/ rw,
+  owner @{run}/user/@{uid}/dconf/user rw,
+
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
   # Needed or opera crashes with the following error:
@@ -133,8 +113,6 @@ profile opera @{exec_path} {
        owner @{PROC}/@{pid}/mounts r,
              @{PROC}/sys/fs/inotify/max_user_watches r,
 
-  owner /dev/shm/.org.chromium.Chromium.* rw,
-
   # To play DRM media (protected content)
   /opt/google/chrome{,-beta,-unstable}/libwidevinecdm.so mr,
   /opt/google/chrome{,-beta,-unstable}/libwidevinecdmadapter.so mr,
@@ -159,14 +137,6 @@ profile opera @{exec_path} {
   # The irq file is needed to render pages.
   @{sys}/devices/pci[0-9]*/**/irq r,
 
-        /var/tmp/ r,
-        /tmp/ r,
-  owner /tmp/.org.chromium.Chromium.* rw,
-  owner /tmp/.org.chromium.Chromium.*/{,*} rw,
-
-  # For installing/updating extensions
-  owner /tmp/scoped_dir*/{,**} rw,
-
   # For crashreporter
   owner /tmp/opera-crashlog-[0-9]*-[0-9]*.txt rw,
 

apparmor.d/groups/browsers/opera-crashreporter

@@ -19,7 +19,6 @@ profile opera-crashreporter @{exec_path} {
   include <abstractions/freedesktop.org>
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>
 
   ptrace (trace, read) peer=opera,
 

apparmor.d/groups/browsers/opera-sandbox

@@ -15,7 +15,6 @@ profile opera-sandbox @{exec_path} {
   include <abstractions/base>
   include <abstractions/fonts>
   include <abstractions/fontconfig-cache-read>
-  include <abstractions/deny-root-dir-access>
 
   # For kernel unprivileged user namespaces
   capability sys_admin,

apparmor.d/groups/desktop/at-spi-bus-launcher

@@ -12,7 +12,6 @@ include <tunables/global>
 profile at-spi-bus-launcher @{exec_path} {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
-  include <abstractions/deny-root-dir-access>
 
   # Needed?
   deny capability sys_nice,

apparmor.d/groups/desktop/at-spi2-registryd

@@ -11,7 +11,6 @@ include <tunables/global>
 profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
-  include <abstractions/deny-root-dir-access>
 
   # Needed?
   deny capability sys_nice,

apparmor.d/groups/desktop/dconf-editor

@@ -14,7 +14,6 @@ profile dconf-editor @{exec_path} {
   include <abstractions/fontconfig-cache-read>
   include <abstractions/freedesktop.org>
   include <abstractions/dconf>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} mr,
 

apparmor.d/groups/gnome/gnome-keyring-daemon

@@ -11,10 +11,7 @@ include <tunables/global>
 profile gnome-keyring-daemon @{exec_path} {
   include <abstractions/base>
   include <abstractions/openssl>
-  include <abstractions/deny-root-dir-access>
 
-  # Remove the following error:
-  #  gnome-keyring-daemon: insufficient process capabilities, unsecure memory might get used
   capability ipc_lock,
 
   signal (send) set=(term) peer=ssh-agent,

apparmor.d/groups/gpg/gpg

@@ -72,6 +72,9 @@ profile gpg @{exec_path} {
   /usr/share/keyrings/*.{gpg,asc} r,
   /etc/keyrings/*.{gpg,asc} r,
 
+  # APT repositories
+  /var/lib/apt/lists/*_InRelease r,
+
   # Verify files
   owner @{HOME}/** r,
   owner @{MOUNTS}/*/** r,

apparmor.d/groups/systemd/systemd-coredump

@@ -19,6 +19,7 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected) {
   capability setgid,
   capability setpcap,
   capability setuid,
+  capability sys_admin,
   capability sys_ptrace,
 
   @{exec_path} mr,
@@ -27,12 +28,15 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected) {
   /{usr/,}sbin/* r,
   @{libexec}/** r,
   /opt/** r,
+  / r,
+
+  mount -> /,
 
   /etc/systemd/coredump.conf r,
 
-  /var/lib/systemd/coredump/ r,
+        /var/lib/systemd/coredump/ r,
-  /var/lib/systemd/coredump/** rwl,
+  owner /var/lib/systemd/coredump/#[0-9]* rw,
-  /var/lib/systemd/coredump/#[0-9]* rwl,
+  owner /var/lib/systemd/coredump/core.*.zst rwl -> /var/lib/systemd/coredump/#[0-9]*,
 
   owner @{PROC}/@{pid}/setgroups r,
         @{PROC}/@{pids}/comm r,

apparmor.d/profiles-a-f/amarok

@@ -46,7 +46,6 @@ profile amarok @{exec_path} {
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
   include <abstractions/devices-usb>
-  include <abstractions/deny-root-dir-access>
 
   ptrace (trace) peer=@{profile_name},
 

apparmor.d/profiles-a-f/anki

@@ -25,7 +25,6 @@ profile anki @{exec_path} {
   include <abstractions/trash>
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>
 
   signal (send) set=(term, kill) peer=anki//mpv,
 

apparmor.d/profiles-a-f/anyremote

@@ -11,7 +11,6 @@ profile anyremote @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
-  include <abstractions/deny-root-dir-access>
 
   signal (receive) set=(int, term, kill),
   signal (send) set=(term, kill),

apparmor.d/profiles-a-f/appimage-beyond-all-reason

@@ -22,18 +22,10 @@ profile appimage-beyond-all-reason @{exec_path} {
   include <abstractions/mesa>
   include <abstractions/ssl_certs>
   include <abstractions/audio>
+  include <abstractions/chromium-common>
 
   capability sys_ptrace,
 
-  # For kernel unprivileged user namespaces
-  capability sys_admin,
-  capability sys_chroot,
-  capability setuid,
-  capability setgid,
-  owner @{PROC}/@{pid}/setgroups w,
-  owner @{PROC}/@{pid}/gid_map w,
-  owner @{PROC}/@{pid}/uid_map w,
-
   network netlink raw,
   network inet dgram,
   network inet6 dgram,
@@ -51,20 +43,13 @@ profile appimage-beyond-all-reason @{exec_path} {
 
   mount fstype={fuse,fuse.*} -> /tmp/.mount_Beyond*/,
 
-    /var/tmp/ r,
+  /tmp/.mount_Beyond*/  rw,
-	    /tmp/ r,
+  /tmp/.mount_Beyond*/beyond-all-reason rix,
-	    /tmp/.mount_Beyond*/  rw,
+  /tmp/.mount_Beyond*/AppRun rix,
-	    /tmp/.mount_Beyond*/beyond-all-reason rix,
+  /tmp/.mount_Beyond*/bin/* rix,
-	    /tmp/.mount_Beyond*/AppRun rix,
+  /tmp/.mount_Beyond*/resources/app.asar.unpacked/node_modules/** rix,
-	    /tmp/.mount_Beyond*/bin/* rix,
+  /tmp/.mount_Beyond*/**  r,
-	    /tmp/.mount_Beyond*/resources/app.asar.unpacked/node_modules/** rix,
+  /tmp/.mount_Beyond*/**.so{,.[0-9]*} mr,
-	    /tmp/.mount_Beyond*/**  r,
-	    /tmp/.mount_Beyond*/**.so{,.[0-9]*} mr,
-  owner /tmp/.org.chromium.Chromium.*/ rw,
-  owner /tmp/.org.chromium.Chromium.*/SingletonCookie rw,
-  owner /tmp/.org.chromium.Chromium.*/SS rw,
-  owner /tmp/.org.chromium.Chromium.*/*.png rw,
-  owner /tmp/.org.chromium.Chromium.* rw,
 
   owner @{user_config_dirs}/Beyond-All-Reason/ rw,
   owner @{user_config_dirs}/Beyond-All-Reason/** rwk,
@@ -76,12 +61,6 @@ profile appimage-beyond-all-reason @{exec_path} {
   owner @{HOME}/.spring/ rw,
   owner @{HOME}/.spring/** rw,
 
-  owner @{HOME}/.pki/ rw,
-  owner @{HOME}/.pki/nssdb/ rw,
-  owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
-
              @{PROC}/ r,
        owner @{PROC}/@{pid}/fd/ r,
   deny owner @{PROC}/@{pid}/cmdline r,
@@ -94,8 +73,6 @@ profile appimage-beyond-all-reason @{exec_path} {
              @{PROC}sys/fs/inotify/max_user_watches r,
              @{PROC}/sys/kernel/yama/ptrace_scope r,
 
-  owner /dev/shm/.org.chromium.Chromium.* rw,
-
   @{sys}/bus/pci/devices/ r,
   @{sys}/devices/pci[0-9]*/**/class r,
   @{sys}/devices/virtual/tty/tty0/active r,

apparmor.d/profiles-a-f/arandr

@@ -16,7 +16,6 @@ profile arandr @{exec_path} {
   include <abstractions/python>
   include <abstractions/user-download-strict>
   include <abstractions/nameservice-strict>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} r,
   /{usr/,}bin/python3.[0-9]* r,

apparmor.d/profiles-a-f/atril

@@ -0,0 +1,96 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+# Ebooks extensions
+# pdf, epub, djvu
+@{atril_ext}   = [pP][dD][fF]
+@{atril_ext}  += [eE][pP][uU][bB]
+@{atril_ext}  += [dD][jJ][vV][uU]
+
+# PNG preview
+@{atril_ext}  += [pP][nN][gG]
+
+@{exec_path} = /{usr/,}bin/atril{,-*}
+profile atril @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/gtk>
+  include <abstractions/fonts>
+  include <abstractions/fontconfig-cache-read>
+  include <abstractions/freedesktop.org>
+  include <abstractions/user-download-strict>
+  include <abstractions/private-files-strict>
+  include <abstractions/nameservice-strict>
+
+  network netlink raw,
+
+  @{exec_path} mr,
+
+  /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/WebKitNetworkProcess rix,
+  /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/WebKitWebProcess rix,
+
+  # Which media files atril should be able to open
+        / r,
+        /home/ r,
+  owner @{HOME}/ r,
+  owner @{HOME}/**/ r,
+        @{MOUNTS}/ r,
+  owner @{MOUNTS}/**/ r,
+        /tmp/ r,
+        /tmp/mozilla_*/ r,
+  owner /{home,media,tmp}/**.@{atril_ext} rw,
+
+  /usr/share/atril/{,**} r,
+
+  /usr/share/glib-2.0/schemas/gschemas.compiled r,
+
+  include <abstractions/dconf>
+  owner @{run}/user/@{uid}/dconf/ rw,
+  owner @{run}/user/@{uid}/dconf/user rw,
+
+       owner @{PROC}/@{pid}/mountinfo r,
+       owner @{PROC}/@{pid}/mounts r,
+       owner @{PROC}/@{pid}/statm r,
+  deny owner @{PROC}/@{pid}/cmdline r,
+       owner @{PROC}/@{pid}/cgroup r,
+             @{PROC}/zoneinfo r,
+
+  /sys/firmware/acpi/pm_profile r,
+  /sys/devices/virtual/dmi/id/chassis_type r,
+  /sys/fs/cgroup/** r,
+
+  /etc/fstab r,
+
+  /usr/share/poppler/** r,
+
+  owner @{user_config_dirs}/atril/ rw,
+  owner @{user_config_dirs}/atril/* rw,
+
+  owner @{user_cache_dirs}/atril/ rw,
+  owner @{user_cache_dirs}/atril/** rw,
+
+  owner @{user_share_dirs}/gvfs-metadata/home r,
+  owner @{user_share_dirs}/gvfs-metadata/home-*.log r,
+
+  owner /tmp/gtkprint_* rw,
+  owner /tmp/atril-@{pid}/ rw,
+  owner /tmp/atril-@{pid}/*/ rw,
+  owner /tmp/atril-@{pid}/*/mimetype rw,
+  owner /tmp/atril-@{pid}/*/META-INF/ rw,
+  owner /tmp/atril-@{pid}/*/META-INF/container.xml rw,
+  owner /tmp/atril-@{pid}/*/index_split_[0-9]*.html rw,
+  owner /tmp/atril-@{pid}/*/page_styles.css rw,
+  owner /tmp/atril-@{pid}/*/titlepage.xhtml rw,
+  owner /tmp/atril-@{pid}/*/stylesheet.css rw,
+  owner /tmp/atril-@{pid}/*/images/ rw,
+  owner /tmp/atril-@{pid}/*/images/*.jpg rw,
+  owner /tmp/atril-@{pid}/*/toc.ncx rw,
+  owner /tmp/atril-@{pid}/*/content.opf rw,
+  owner /tmp/atril-@{pid}/*/META-INF/calibre_bookmarks.txt rw,
+
+  include if exists <local/atril>
+}

apparmor.d/profiles-a-f/atrild

@@ -0,0 +1,22 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+# Ebooks extensions
+# pdf, epub, djvu
+@{qpdfview_ext}   = [pP][dD][fF]
+@{qpdfview_ext}  += [eE][pP][uU][bB]
+@{qpdfview_ext}  += [dD][jJ][vV][uU]
+
+@{exec_path} = /{usr/,}lib/atril/atrild
+profile atrild @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  include if exists <local/atrild>
+}

apparmor.d/profiles-a-f/birdtray

@@ -20,7 +20,6 @@ profile birdtray @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>
 
   network inet dgram,
   network inet6 dgram,
@@ -71,7 +70,6 @@ profile birdtray @{exec_path} {
 
   # file_inherit
   owner /dev/tty[0-9]* rw,
-  owner @{HOME}/.xsession-errors w,
 
 
   profile open {

apparmor.d/profiles-a-f/cawbird

@@ -18,7 +18,6 @@ profile cawbird @{exec_path} {
   include <abstractions/enchant>
   include <abstractions/audio>
   include <abstractions/gstreamer>
-  include <abstractions/deny-root-dir-access>
 
   network inet dgram,
   network inet6 dgram,

apparmor.d/profiles-a-f/claws-mail

@@ -19,7 +19,6 @@ profile claws-mail @{exec_path} flags=(complain) {
   include <abstractions/audio>
   include <abstractions/thumbnails-cache-read>
   include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} mr,
 
@@ -66,9 +65,6 @@ profile claws-mail @{exec_path} flags=(complain) {
   /usr/share/sounds/freedesktop/stereo/*.oga r,
   /usr/share/publicsuffix/*.dafsa r,
 
-  # file_inherit
-  owner @{HOME}/.xsession-errors w,
-
 
   profile gpg {
     include <abstractions/base>

apparmor.d/profiles-a-f/compton

@@ -9,7 +9,6 @@ include <tunables/global>
 @{exec_path} = /{usr/,}bin/compton
 profile compton @{exec_path} {
   include <abstractions/base>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} mr,
 

apparmor.d/profiles-a-f/conky

@@ -16,7 +16,6 @@ profile conky @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>
 
   # To get the external IP address
   # For samba share mounts
@@ -157,8 +156,11 @@ profile conky @{exec_path} {
     include <abstractions/openssl>
     include <abstractions/ssl_certs>
 
-    network inet,
+    network inet dgram,
-    network inet6,
+    network inet6 dgram,
+    network inet stream,
+    network inet6 stream,
+    network netlink raw,
 
     /{usr/,}bin/wget mr,
     /{usr/,}bin/curl mr,

apparmor.d/profiles-a-f/convertall

@@ -19,7 +19,6 @@ profile convertall @{exec_path} {
   include <abstractions/python>
   include <abstractions/qt5-compose-cache-write>
   include <abstractions/nameservice-strict>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} r,
   /{usr/,}bin/{,ba,da}sh     rix,

apparmor.d/profiles-a-f/deltachat-desktop

@@ -23,14 +23,7 @@ profile deltachat-desktop @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
   include <abstractions/user-download-strict>
-
+  include <abstractions/chromium-common>
-  # The following rules are needed only when the kernel.unprivileged_userns_clone option is set
-  # to "1".
-  capability sys_admin,
-  capability sys_chroot,
-  owner @{PROC}/@{pid}/setgroups w,
-  owner @{PROC}/@{pid}/gid_map w,
-  owner @{PROC}/@{pid}/uid_map w,
 
   network inet dgram,
   network inet6 dgram,
@@ -59,13 +52,6 @@ profile deltachat-desktop @{exec_path} {
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
-        /var/tmp/ r,
-        /tmp/ r,
-  owner /tmp/.org.chromium.Chromium.*/ rw,
-  owner /tmp/.org.chromium.Chromium.*/SingletonCookie w,
-  owner /tmp/.org.chromium.Chromium.*/SS w,
-  owner /tmp/.org.chromium.Chromium.*/*.png rw,
-  owner /tmp/.org.chromium.Chromium.* rw,
   owner /tmp/[0-9a-f]*/ rw,
   owner /tmp/[0-9a-f]*/db.sqlite-blobs/ rw,
   owner /tmp/[0-9a-f]*/db.sqlite rwk,
@@ -85,8 +71,6 @@ profile deltachat-desktop @{exec_path} {
              @{PROC}/sys/fs/inotify/max_user_watches r,
 
         /dev/ r,
-        /dev/shm/ r,
-  owner /dev/shm/.org.chromium.Chromium.* rw,
 
   # (#FIXME#)
   deny @{sys}/bus/pci/devices/ r,

apparmor.d/profiles-a-f/dhclient-script

@@ -57,8 +57,7 @@ profile dhclient-script @{exec_path} {
   /{usr/,}bin/ip        rix,
 
   # For loadbalance
-  /etc/iproute2/rt_tables r,
+  /etc/iproute2/** r,
-  /etc/iproute2/rt_tables.d/{,*} r,
   owner @{PROC}/@{pid}/loginuid r,
 
   # For updating the /etc/resolv.conf file
@@ -91,7 +90,7 @@ profile dhclient-script @{exec_path} {
   @{run}/chrony-dhcp/ rw,
 
   # file_inherit
-  /var/lib/dhcp/dhclient.leases r,
+  /var/lib/dhcp/*.leases r,
 
 
   profile run-parts {
@@ -102,7 +101,7 @@ profile dhclient-script @{exec_path} {
     /etc/dhcp/dhclient-{enter,exit}-hooks.d/ r,
 
     # file_inherit
-    owner /var/lib/dhcp/dhclient.leases r,
+    /var/lib/dhcp/*.leases r,
 
   }
 

apparmor.d/profiles-a-f/engrampa

@@ -16,7 +16,6 @@ profile engrampa @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/user-download-strict>
   include <abstractions/thumbnails-cache-read>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} mr,
 
@@ -75,6 +74,8 @@ profile engrampa @{exec_path} {
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
+  /etc/magic r,
+
   owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/fd/ r,
         @{PROC}/@{pid}/mountinfo r,

apparmor.d/profiles-a-f/evince

@@ -10,7 +10,6 @@ include <tunables/global>
 profile evince @{exec_path} {
   include <abstractions/base>
   include <abstractions/dconf>
-  include <abstractions/deny-root-dir-access>
   include <abstractions/gnome>
   include <abstractions/openssl>
   include <abstractions/user-download-strict>

apparmor.d/profiles-a-f/execute-dcut

@@ -10,7 +10,6 @@ include <tunables/global>
 profile execute-dcut @{exec_path} flags=(complain) {
   include <abstractions/base>
   include <abstractions/python>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} r,
   /{usr/,}bin/python3.[0-9]* r,

apparmor.d/profiles-a-f/execute-dput

@@ -11,7 +11,6 @@ profile execute-dput @{exec_path} flags=(complain) {
   include <abstractions/base>
   include <abstractions/python>
   include <abstractions/nameservice-strict>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} r,
   /{usr/,}bin/python3.[0-9]* r,

apparmor.d/profiles-a-f/ffmpeg

@@ -45,13 +45,13 @@ include <tunables/global>
 @{exec_path} = /{usr/,}bin/ffmpeg
 profile ffmpeg @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
   include <abstractions/dri-common>
   include <abstractions/audio>
   include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
   include <abstractions/user-download-strict>
   include <abstractions/private-files-strict>
-  include <abstractions/deny-root-dir-access>
 
   network inet dgram,
   network inet6 dgram,

apparmor.d/profiles-a-f/ffplay

@@ -45,7 +45,6 @@ profile ffplay @{exec_path} {
   include <abstractions/audio>
   include <abstractions/user-download-strict>
   include <abstractions/private-files-strict>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} mr,
 

apparmor.d/profiles-a-f/ffprobe

@@ -40,10 +40,10 @@ include <tunables/global>
 @{exec_path} = /{usr/,}bin/ffprobe
 profile ffprobe @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
   include <abstractions/dri-common>
   include <abstractions/user-download-strict>
   include <abstractions/private-files-strict>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} mr,
 

apparmor.d/profiles-a-f/fusermount

@@ -29,7 +29,7 @@ profile fusermount @{exec_path} {
   mount fstype={fuse,fuse.*} -> @{HOME}/.cache/**/,
   mount fstype={fuse,fuse.*} -> @{MOUNTS}/*/,
   mount fstype={fuse,fuse.*} -> @{MOUNTS}/*/*/,
-  mount fstype={fuse,fuse.*} -> @{run}/user/@{uid}/doc/,
+  mount fstype={fuse,fuse.*} -> @{run}/user/@{uid}/*/,
 
   umount @{HOME}/*/,
   umount @{HOME}/*/*/,
@@ -37,8 +37,7 @@ profile fusermount @{exec_path} {
   umount @{MOUNTS}/*/,
   umount @{MOUNTS}/*/*/,
   umount /tmp/.mount_*/,
-  umount @{run}/user/@{uid}/doc/,
+  umount @{run}/user/@{uid}/*/,
-  umount @{run}/user/@{uid}/gvfs/,
 
   /etc/fuse.conf r,
   /etc/machine-id r,

apparmor.d/profiles-g-l/gajim

@@ -25,7 +25,6 @@ profile gajim @{exec_path} {
   include <abstractions/ssl_certs>
   include <abstractions/gstreamer>
   include <abstractions/enchant>
-  include <abstractions/deny-root-dir-access>
 
   network inet dgram,
   network inet6 dgram,

apparmor.d/profiles-g-l/games-wesnoth

@@ -16,7 +16,6 @@ profile games-wesnoth @{exec_path} {
   include <abstractions/audio>
   include <abstractions/mesa>
   include <abstractions/nameservice-strict>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} mrix,
 

apparmor.d/profiles-g-l/games-wesnoth-sh

@@ -9,7 +9,6 @@ include <tunables/global>
 @{exec_path} = /usr/games/wesnoth-[0-9]*{-nolog,-smalgui,_editor} /usr/games/wesnoth-nolog
 profile games-wesnoth-sh @{exec_path} {
   include <abstractions/base>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} r,
   /{usr/,}bin/{,ba,da}sh       rix,

apparmor.d/profiles-g-l/ganyremote

@@ -18,7 +18,6 @@ profile ganyremote @{exec_path} {
   include <abstractions/user-download-strict>
   include <abstractions/python>
   include <abstractions/thumbnails-cache-read>
-  include <abstractions/deny-root-dir-access>
 
   network inet stream,
   network inet6 stream,

apparmor.d/profiles-g-l/globaltime

@@ -13,7 +13,6 @@ profile globaltime @{exec_path} {
   include <abstractions/fonts>
   include <abstractions/fontconfig-cache-read>
   include <abstractions/freedesktop.org>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} mr,
 

apparmor.d/profiles-g-l/gpa

@@ -15,7 +15,6 @@ profile gpa @{exec_path} {
   include <abstractions/fontconfig-cache-read>
   include <abstractions/user-download-strict>
   include <abstractions/nameservice-strict>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} mr,
 

apparmor.d/profiles-g-l/gpo

@@ -15,7 +15,6 @@ profile gpo @{exec_path} {
   include <abstractions/user-download-strict>
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>
 
   network inet dgram,
   network inet6 dgram,

apparmor.d/profiles-g-l/gpodder

@@ -18,7 +18,6 @@ profile gpodder @{exec_path} {
   include <abstractions/user-download-strict>
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>
 
   network inet dgram,
   network inet6 dgram,

apparmor.d/profiles-g-l/gpodder-migrate2tres

@@ -10,7 +10,6 @@ include <tunables/global>
 profile gpodder-migrate2tres @{exec_path} {
   include <abstractions/base>
   include <abstractions/python>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} r,
   /{usr/,}bin/python3.[0-9]* r,

apparmor.d/profiles-g-l/gsmartcontrol

@@ -14,7 +14,6 @@ profile gsmartcontrol @{exec_path} {
   include <abstractions/fontconfig-cache-read>
   include <abstractions/freedesktop.org>
   include <abstractions/nameservice-strict>
-  include <abstractions/deny-dconf>
 
   capability dac_read_search,
 
@@ -67,9 +66,6 @@ profile gsmartcontrol @{exec_path} {
   # hence this behavior should be blocked.
   deny /{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop rx,
 
-  # file_inherit
-  owner @{HOME}/.xsession-errors w,
-
 
   profile dbus {
     include <abstractions/base>

apparmor.d/profiles-g-l/gtk-youtube-viewer

@@ -17,7 +17,6 @@ profile gtk-youtube-viewer @{exec_path} {
   include <abstractions/perl>
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>
 
   network inet dgram,
   network inet6 dgram,

apparmor.d/profiles-g-l/hardinfo

@@ -38,7 +38,7 @@ profile hardinfo @{exec_path} {
   /{usr/,}bin/python2.[0-9]*  rix,
   /{usr/,}bin/python3.[0-9]*  rix,
   /{usr/,}bin/perl            rix,
-  /{usr/,}bin/ruby2.[0-9]*    rix,
+  /{usr/,}bin/ruby[0-9].[0-9]* rix,
   /{usr/,}bin/make            rix,
   /{usr/,}bin/strace          rix,
   /{usr/,}bin/gdb             rix,

apparmor.d/profiles-g-l/hexchat

@@ -21,7 +21,6 @@ profile hexchat @{exec_path} {
   # For python/perl plugins
   include <abstractions/python>
   include <abstractions/perl>
-  include <abstractions/deny-root-dir-access>
 
   network inet dgram,
   network inet6 dgram,

apparmor.d/profiles-g-l/hypnotix

@@ -31,6 +31,7 @@ profile hypnotix @{exec_path} {
   include <abstractions/python>
 
   signal (send) set=(term, kill) peer=youtube-dl,
+  signal (send) set=(term, kill) peer=yt-dlp,
 
   network inet dgram,
   network inet6 dgram,
@@ -48,7 +49,8 @@ profile hypnotix @{exec_path} {
 
   /{usr/,}bin/xdg-screensaver rCx -> xdg-screensaver,
 
-  /{usr/,}bin/youtube-dl      rPx,
+  /{usr/,}bin/youtube-dl     rPUx,
+  /{usr/,}bin/yt-dlp         rPUx,
   /{usr/,}lib/firefox/firefox rPx,
 
   # Which files hypnotix should be able to open

apparmor.d/profiles-g-l/ifup

@@ -23,14 +23,20 @@ profile ifup @{exec_path} {
   /{usr/,}bin/{,ba,da}sh rix,
   /{usr/,}bin/ip         rix,
   /{usr/,}bin/sleep      rix,
+  /{usr/,}bin/seq        rix,
 
   /{usr/,}{s,}bin/dhclient  rPx,
   /{usr/,}bin/macchanger rPx,
 
+  /{usr/,}lib/ifupdown/*.sh rix,
+
   /{usr/,}bin/run-parts  rCx -> run-parts,
+  /{usr/,}bin/kmod       rCx -> kmod,
+  /{usr/,}sbin/sysctl    rCx -> sysctl,
 
   /etc/network/interfaces r,
   /etc/network/interfaces.d/{,*} r,
+  /etc/iproute2/rt_scopes r,
 
   @{run}/network/ rw,
   @{run}/network/{.,}ifstate* rwk,
@@ -82,5 +88,37 @@ profile ifup @{exec_path} {
 
   }
 
+  profile kmod {
+    include <abstractions/base>
+
+    /{usr/,}bin/kmod mr,
+
+    @{sys}/module/** r,
+
+    @{PROC}/cmdline r,
+    @{PROC}/modules r,
+
+    /etc/modprobe.d/ r,
+    /etc/modprobe.d/*.conf r,
+
+  }
+
+  profile sysctl {
+    include <abstractions/base>
+
+#    capability mac_admin,
+#    capability sys_admin,
+#    capability sys_resource,
+
+    /{usr/,}sbin/sysctl mr,
+
+    @{PROC}/sys/ r,
+    @{PROC}/sys/** r,
+
+    @{PROC}/sys/net/ipv6/conf/*/accept_ra rw,
+    @{PROC}/sys/net/ipv6/conf/*/autoconf rw,
+
+  }
+
   include if exists <local/ifup>
 }

apparmor.d/profiles-g-l/jdownloader

@@ -17,7 +17,6 @@ profile jdownloader @{exec_path} {
   include <abstractions/freedesktop.org>
   include <abstractions/user-download-strict>
   include <abstractions/nameservice-strict>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} rix,
 

apparmor.d/profiles-g-l/jdownloader-install

@@ -17,7 +17,6 @@ profile jdownloader-install @{exec_path} {
   include <abstractions/fonts>
   include <abstractions/fontconfig-cache-read>
   include <abstractions/nameservice-strict>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} r,
   /{usr/,}bin/{,ba,da}sh rix,

apparmor.d/profiles-g-l/jekyll

@@ -13,12 +13,16 @@ profile jekyll @{exec_path} {
   include <abstractions/base>
   include <abstractions/ruby>
   include <abstractions/nameservice-strict>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} r,
-  /{usr/,}bin/ruby2.[0-9]* r,
+  /{usr/,}bin/ruby[0-9].[0-9]* rix,
 
-  /usr/share/rubygems-integration/** r,
+  /usr/share/rubygems-integration/*/specifications/ r,
+  /usr/share/rubygems-integration/*/specifications/*.gemspec rwk,
+
+  /{usr/,}lib/ruby/gems/*/specifications/ r,
+  /{usr/,}lib/ruby/gems/*/specifications/** r,
+  /{usr/,}lib/ruby/gems/*/specifications/**.gemspec rwk,
 
   /usr/share/ruby-addressable/unicode.data r,
 

apparmor.d/profiles-g-l/jgmenu

@@ -15,7 +15,6 @@ profile jgmenu @{exec_path} {
   include <abstractions/fontconfig-cache-read>
   include <abstractions/freedesktop.org>
   include <abstractions/nameservice-strict>
-  include <abstractions/deny-root-dir-access>
   include <abstractions/app-launcher-user>
 
   @{exec_path} mrix,

apparmor.d/profiles-g-l/kanyremote

@@ -22,7 +22,6 @@ profile kanyremote @{exec_path} {
   include <abstractions/mesa>
   include <abstractions/qt5-compose-cache-write>
   include <abstractions/qt5-settings-write>
-  include <abstractions/deny-root-dir-access>
 
   network inet stream,
   network inet6 stream,

apparmor.d/profiles-g-l/keepassxc

@@ -25,7 +25,6 @@ profile keepassxc @{exec_path} {
   include <abstractions/openssl>
   include <abstractions/ssl_certs>
   include <abstractions/devices-usb>
-  include <abstractions/deny-root-dir-access>
 
   network inet dgram,
   network inet6 dgram,

apparmor.d/profiles-g-l/keepassxc-cli

@@ -9,7 +9,6 @@ include <tunables/global>
 @{exec_path} = /{usr/,}bin/keepassxc-cli
 profile keepassxc-cli @{exec_path} {
   include <abstractions/base>
-  include <abstractions/deny-root-dir-access>
 
   @{exec_path} mr,
 

apparmor.d/profiles-g-l/keepassxc-proxy

@@ -10,7 +10,6 @@ include <tunables/global>
 profile keepassxc-proxy @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
-  include <abstractions/deny-root-dir-access>
 
   signal (receive) set=(term, kill),