feat(profile): general update.

apparmor.d/groups/freedesktop/plymouthd

@@ -10,7 +10,8 @@ include <tunables/global>
 profile plymouthd @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
-  include <abstractions/dri-common>
+  include <abstractions/dri>
+  include <abstractions/fonts>
 
   capability checkpoint_restore,
   capability dac_override,
@@ -52,7 +53,6 @@ profile plymouthd @{exec_path} {
   @{sys}/class/ r,
   @{sys}/class/drm/ r,
   @{sys}/class/graphics/ r,
-  @{sys}/devices/@{pci}/{,uevent,vendor,device} r,
   @{sys}/devices/virtual/graphics/fbcon/uevent r,
   @{sys}/devices/virtual/tty/console/active r,
   @{sys}/firmware/acpi/bgrt/{,*} r,

apparmor.d/groups/freedesktop/xprop

@@ -8,7 +8,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = @{bin}/xprop
-profile xprop @{exec_path} {
+profile xprop @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/freedesktop.org>
   include <abstractions/X-strict>

apparmor.d/groups/freedesktop/xsetroot

@@ -14,6 +14,8 @@ profile xsetroot @{exec_path} {
 
   capability dac_read_search,
 
+  signal (receive) set=(kill) peer=sddm,
+
   @{exec_path} mr,
 
   /usr/share/icons/{,**} r,

apparmor.d/groups/kde/baloorunner

@@ -30,5 +30,7 @@ profile baloorunner @{exec_path} {
 
   @{PROC}/sys/kernel/core_pattern r,
 
+  /dev/tty r,
+
   include if exists <local/baloorunner>
 }

apparmor.d/groups/kde/dolphin

@@ -15,6 +15,7 @@ profile dolphin @{exec_path} {
   include <abstractions/bus/org.freedesktop.UDisks2>
   include <abstractions/deny-sensitive-home>
   include <abstractions/devices-usb>
+  include <abstractions/disks-read>
   include <abstractions/graphics>
   include <abstractions/kde-strict>
   include <abstractions/nameservice-strict>
@@ -45,9 +46,15 @@ profile dolphin @{exec_path} {
 
   # Full access to user's data
   / r,
+  /*/ r,
+  @{bin}/ r,
+  @{lib}/ r,
+  @{MOUNTDIRS}/ r,
+  @{MOUNTS}/ r,
+  @{MOUNTS}/** rw,
   owner @{HOME}/{,**} rw,
-
-  /var/lib/flatpak/exports/share/mime/ r,
+  owner @{run}/user/@{uid}/{,**} rw,
+  owner /tmp/{,**} rw,
 
   # Silence non user's data
   deny /boot/{,**} r,
@@ -65,7 +72,7 @@ profile dolphin @{exec_path} {
   owner @{user_config_dirs}/dolphinrc.@{rand6} rwl -> @{user_config_dirs}/#@{int},
   owner @{user_config_dirs}/dolphinrc.lock rwk,
   owner @{user_config_dirs}/kde.org/#@{int} rw,
-  owner @{user_config_dirs}/kde.org/UserFeedback.org.kde.dolphin.conf{,.@{rand6}} rwlk -> @{user_config_dirs}/kde.org/#@{int},
+  owner @{user_config_dirs}/kde.org/UserFeedback.org.kde.dolphin.conf{,.*} rwlk -> @{user_config_dirs}/kde.org/#@{int},
   owner @{user_config_dirs}/kde.org/UserFeedback.org.kde.dolphin.conf.lock rwk,
 
   owner @{user_config_dirs}/session/ rw,

apparmor.d/groups/kde/konsole

@@ -36,23 +36,24 @@ profile konsole @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   /usr/share/sounds/** r,
 
   /etc/xdg/konsolerc r,
+  /etc/xdg/kshorturifilterrc r,
   /etc/xdg/menus/{,**} r,
   /etc/xdg/ui/ui_standards.rc r,
 
   owner @{HOME}/@{XDG_SSH_DIR}/config r,
 
-  owner @{user_config_dirs}/#@{int} rwl,
+  owner @{user_cache_dirs}/icon-cache.kcache rw,
   owner @{user_cache_dirs}/ksycoca{5,6}_* r,
 
+  owner @{user_config_dirs}/#@{int} rwl,
   owner @{user_config_dirs}/breezerc r,
   owner @{user_config_dirs}/konsolerc{,*} rwlk,
   owner @{user_config_dirs}/konsolesshconfig rwl -> @{user_config_dirs}/#@{int},
   owner @{user_config_dirs}/konsolesshconfig.@{rand6} rwl -> @{user_config_dirs}/#@{int},
   owner @{user_config_dirs}/konsolesshconfig.lock rwk,
+  owner @{user_config_dirs}/kservicemenurc r,
   owner @{user_config_dirs}/menus/{,**} r,
 
-  owner @{user_cache_dirs}/icon-cache.kcache rw,
-
   owner @{user_share_dirs}/color-schemes/{,**} r,
   owner @{user_share_dirs}/konsole/ rw,
   owner @{user_share_dirs}/konsole/** rwlk,

apparmor.d/groups/kde/kwin_wayland

@@ -52,6 +52,9 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) {
   /etc/machine-id r,
   /var/lib/dbus/machine-id r,
 
+  / r,
+  owner @{HOME}/ r,
+
   owner @{sddm_cache_dirs}/#@{int} rwk,
   owner @{sddm_cache_dirs}/fontconfig/* rwk,
   owner @{sddm_cache_dirs}/fontconfig/*-le64.cache-@{int}.LCK l -> @{sddm_cache_dirs}/fontconfig/*-le64.cache-@{int}.TMP-@{rand6},
@@ -73,7 +76,7 @@ profile kwin_wayland @{exec_path} flags=(attach_disconnected mediate_deleted) {
   owner @{user_cache_dirs}/ksycoca{5,6}_* r,
   owner @{user_cache_dirs}/ksycoca{5,6}_* rwkl -> @{user_cache_dirs}/#@{int},
   owner @{user_cache_dirs}/kwin/ rw,
-  owner @{user_cache_dirs}/kwin/** rwl -> @{user_cache_dirs}/kwin/**,
+  owner @{user_cache_dirs}/kwin/** rwkl -> @{user_cache_dirs}/kwin/**,
   owner @{user_cache_dirs}/plasma_theme_*.kcache rw,
   owner @{user_cache_dirs}/plasma-svgelements rw,
   owner @{user_cache_dirs}/plasma-svgelements.@{rand6} rwl -> @{user_cache_dirs}/#@{int},

apparmor.d/groups/kde/plasmashell

@@ -78,8 +78,9 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
   /etc/fstab r,
   /etc/ksysguarddrc r,
   /etc/machine-id r,
-  /etc/sensors3.conf r,
+  /etc/os-release r,
   /etc/sensors.d/ r,
+  /etc/sensors3.conf r,
   /etc/xdg/** r,
 
   /var/lib/AccountsService/icons/* r,

apparmor.d/groups/kde/sddm

@@ -42,6 +42,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   signal (receive) set=(hup) peer=@{p_systemd},
   signal (send) set=(kill, term) peer=startplasma,
   signal (send) set=(kill, term) peer=xorg,
+  signal (send) set=(kill, term) peer=xsetroot,
   signal (send) set=(term) peer=kwin_wayland,
   signal (send) set=(term) peer=sddm-greeter,
   signal (send) set=(term) peer=startplasma-wayland,
@@ -76,6 +77,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   @{bin}/disable-paste rix,
   @{bin}/locale        rix,
   @{bin}/manpath       rix,
+  @{bin}/mktemp        rix,
   @{bin}/pidof         rix,
   @{bin}/readlink      rix,
   @{bin}/realpath      rix,
@@ -151,6 +153,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   owner @{sddm_cache_dirs}/sddm-greeter/qmlcache/*.jsc mrw,
   owner @{sddm_cache_dirs}/sddm-greeter/qmlcache/*.qmlc mrw,
 
+  owner @{HOME}/ r,
   owner @{HOME}/.local/ w,
   owner @{HOME}/.Xauthority rw,
 

apparmor.d/groups/kde/sddm-greeter

@@ -37,6 +37,7 @@ profile sddm-greeter @{exec_path} {
   /usr/share/hunspell/** r,
 
   /etc/fstab r,
+  /etc/os-release r,
   /etc/sddm.conf r,
   /etc/sddm.conf.d/{,*} r,
   /etc/xdg/plasmarc r,

apparmor.d/groups/pacman/mkinitcpio

@@ -76,9 +76,10 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) {
   /etc/locale.conf r,
   /etc/lvm/lvm.conf r,
   /etc/mkinitcpio.conf r,
-  /etc/mkinitcpio.d/{,**} r,
   /etc/mkinitcpio.conf.d/{,**} r,
+  /etc/mkinitcpio.d/{,**} r,
   /etc/modprobe.d/{,*} r,
+  /etc/os-release r,
   /etc/plymouth/plymouthd.conf r,
   /etc/vconsole.conf r,
 

apparmor.d/groups/systemd/systemd-generator-gpt-auto

@@ -20,6 +20,7 @@ profile systemd-generator-gpt-auto @{exec_path} flags=(attach_disconnected)  {
   /boot/ r,
   /efi/ r,
   /etc/fstab r,
+  /usr/ r,
 
   @{run}/systemd/generator.late/**.{,auto}mount w,
   @{run}/systemd/generator.late/local-fs.target.wants/ w,

apparmor.d/groups/systemd/systemd-hostnamed

@@ -32,6 +32,7 @@ profile systemd-hostnamed @{exec_path}  flags=(attach_disconnected) {
   /etc/.#machine-info@{rand6} rw,
   /etc/machine-id r,
   /etc/machine-info rw,
+  /etc/os-release r,
 
   @{run}/systemd/default-hostname rw,
   @{run}/systemd/notify rw,

apparmor.d/groups/systemd/systemd-shutdown

@@ -17,6 +17,8 @@ profile systemd-shutdown @{exec_path} {
   capability sys_ptrace,
   capability sys_resource,
 
+  mount options=(rw rprivate) -> /,
+
   signal (send)    set=(stop, cont, term, kill),
   signal (receive) set=(rtmin+23) peer=plymouthd,
 
@@ -24,6 +26,7 @@ profile systemd-shutdown @{exec_path} {
 
         @{PROC}/ r,
         @{PROC}/@{pid}/fd/ r,
+        @{PROC}/@{pid}/fdinfo/@{int} r,
         @{PROC}/@{pids}/cmdline r,
   owner @{PROC}/@{pid}/comm r,
   owner @{PROC}/sys/kernel/core_pattern w,

apparmor.d/profiles-a-f/cups-backend-usb

@@ -11,6 +11,8 @@ profile cups-backend-usb @{exec_path} {
   include <abstractions/base>
   include <abstractions/devices-usb>
 
+  capability net_admin,
+
   network netlink raw,
 
   @{exec_path} mr,

apparmor.d/profiles-m-r/plocate

@@ -10,6 +10,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/plocate
 profile plocate @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
 
   # For running as root
   capability dac_read_search,

apparmor.d/profiles-s-z/smbspool

@@ -0,0 +1,18 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{bin}/smbspool
+profile smbspool @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  /etc/papersize r,
+
+  include if exists <local/smbspool>
+}

apparmor.d/profiles-s-z/sudo

@@ -14,6 +14,7 @@ profile sudo @{exec_path} flags=(attach_disconnected) {
   include <abstractions/app/sudo>
 
   capability chown,
+  capability fowner,
   capability mknod,
   capability sys_ptrace,
 

apparmor.d/profiles-s-z/udisksd

@@ -47,6 +47,9 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
   mount fstype={btrfs,ext*,vfat,exfat,iso9660,udf,ntfs3} /dev/mmcblk[0-9]         -> @{MOUNTS}/*/,
   mount fstype={btrfs,ext*,vfat,exfat,iso9660,udf,ntfs3} /dev/mmcblk[0-9]*p[0-9]* -> @{MOUNTS}/*/,
 
+  mount options=(rw move) -> @{MOUNTS}/,
+  mount options=(rw move) -> @{MOUNTS}/*/,
+
   # Allow mounting on temporary mount point
   mount -> @{run}/udisks2/temp-mount-*/,
   mount / -> @{MOUNTS}/*/,

apparmor.d/profiles-s-z/whatis

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2024 Zane Zakraisek <zz@eng.utah.edu>
+# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -24,5 +25,8 @@ profile whatis @{exec_path} {
 
   owner @{HOME}/.manpath r,
 
+  owner @{user_share_dirs}/man/{,**/}{,whatis} r,
+  owner @{user_share_dirs}/man/{,**/}index.{bt,db,dir,pag} rk,
+
   include if exists <local/whatis>
 }

apparmor.d/profiles-s-z/zpool

@@ -18,15 +18,18 @@ profile zpool @{exec_path} {
   @{sh_path}        rix,
   /{usr/,}{local/,}lib/zfs-linux/zpool.d/* rix,
 
+  /usr/share/zfs/{,**} r,
+
   /etc/hostid r,
   /etc/zfs/*.cache rwk,
 
+  /tmp/tmp.* rw,
+
   @{run}/blkid/blkid.tab rw,
   @{run}/blkid/blkid.tab.old rwl,
   @{run}/blkid/blkid.tab-@{rand6} rwl,
 
-  /tmp/tmp.* rw,
-
+  @{sys}/module/zfs/** r,
   @{sys}/bus/pci/slots/ r,
   @{sys}/bus/pci/slots/@{int}/address r,