update apparmor profiles

2024-11-14 23:43:56 +01:00 · 2021-05-26 10:49:17 +02:00 · 2021-05-26 10:49:17 +02:00 · e085014238
commit e085014238
parent 1ab54c1ed1
37 changed files with 447 additions and 56 deletions
--- a/apparmor.d/abstractions/gstreamer
+++ b/apparmor.d/abstractions/gstreamer
@ -13,6 +13,11 @@
  #/etc/udev/udev.conf r,
  #/etc/wildmidi/wildmidi.cfg r,

+  /etc/openni2/OpenNI.ini r,
+
+      /tmp/ r,
+  /var/tmp/ r,
+
  /dev/ r,
  /dev/bus/usb/ r,
  /dev/dri/ r,
@ -21,16 +26,19 @@
  #owner /{dev,run}/shm/shmfd-* rw,

  #
-  @{run}/udev/data/c81:*  r,     # For video4linux
-  @{run}/udev/data/c226:* r,     # For /dev/dri/card[0-9]*
-  @{run}/udev/data/+drm:* r,     # For screen outputs
-  #@{run}/udev/data/+pci:* r,
-  @{run}/udev/data/+usb:* r,
+  @{run}/udev/data/c81:[0-9]*  r,     # For video4linux
+  @{run}/udev/data/c189:[0-9]* r,     # For /dev/bus/usb/**
+  @{run}/udev/data/c226:[0-9]* r,     # For /dev/dri/card[0-9]*
+  @{run}/udev/data/+drm:*      r,     # For screen outputs
+  #@{run}/udev/data/+pci:*     r,
+  @{run}/udev/data/+usb:*      r,     # For /dev/bus/usb/**

  @{sys}/bus/ r,
  @{sys}/bus/usb/devices/ r,
+  @{sys}/bus/media/devices/ r,
  @{sys}/class/ r,
  @{sys}/class/drm/ r,
+  @{sys}/class/video4linux/ r,
  @{sys}/devices/pci[0-9]*/**/{busnum,config,devnum,descriptors,speed,uevent} r,
  @{sys}/devices/system/node/ r,
  @{sys}/devices/system/node/node[0-9]*/meminfo r,
--- a/apparmor.d/abstractions/qt5-shader-cache
+++ b/apparmor.d/abstractions/qt5-shader-cache
@ -0,0 +1,12 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+  abi <abi/3.0>,
+
+  owner @{HOME}/.cache/qtshadercache/ rw,
+  owner @{HOME}/.cache/qtshadercache/#[0-9]*[0-9] rw,
+  owner @{HOME}/.cache/qtshadercache/[0-9a-f]* rwl -> @{HOME}/.cache/qtshadercache/#[0-9]*[0-9],
+  owner @{HOME}/.cache/qtshadercache-*-little_endian-*/ rw,
+  owner @{HOME}/.cache/qtshadercache-*-little_endian-*/#[0-9]*[0-9] rw,
+  owner @{HOME}/.cache/qtshadercache-*-little_endian-*/[0-9a-f]* rwl -> @{HOME}/.cache/qtshadercache-*-little_endian-*/#[0-9]*[0-9],
--- a/apparmor.d/groups/apps/calibre
+++ b/apparmor.d/groups/apps/calibre
@ -32,6 +32,7 @@ profile calibre @{exec_path} {
  include <abstractions/mesa>
  include <abstractions/qt5-compose-cache-write>
  include <abstractions/qt5-settings-write>
+  include <abstractions/qt5-shader-cache>
  include <abstractions/thumbnails-cache-read>
  include <abstractions/user-download-strict>
  include <abstractions/nameservice-strict>
--- a/apparmor.d/groups/apps/dropbox
+++ b/apparmor.d/groups/apps/dropbox
@ -56,6 +56,7 @@ profile dropbox @{exec_path} {
  /{usr/,}bin/dirname    rix,
  /{usr/,}bin/uname      rix,
  /{usr/,}{s,}bin/ldconfig rix,
+  /{usr/,}lib/llvm-[0-9]*/bin/clang      rix,
  /{usr/,}bin/{,@{multiarch}-}gcc-[0-9]* rix,
  /{usr/,}bin/{,@{multiarch}-}objdump    rix,

--- a/apparmor.d/groups/apps/usr.lib.libreoffice.program.soffice.bin
+++ b/apparmor.d/groups/apps/usr.lib.libreoffice.program.soffice.bin
@ -73,32 +73,32 @@

@{libo_user_dirs} = @{HOME} /mnt /media

-include <tunables/global>
+#include <tunables/global>

 profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(complain) {
-  include <abstractions/private-files>
+  #include <abstractions/private-files>

-  include <abstractions/audio>
-  include <abstractions/bash>
-  include <abstractions/cups-client>
-  include <abstractions/dbus>
-  include <abstractions/dbus-session>
-  include <abstractions/dbus-accessibility>
-  include <abstractions/dri-enumerate>
-  include <abstractions/mesa>
-  include <abstractions/ibus>
-  include <abstractions/nameservice>
-  include <abstractions/gnome>
+  #include <abstractions/audio>
+  #include <abstractions/bash>
+  #include <abstractions/cups-client>
+  #include <abstractions/dbus>
+  #include <abstractions/dbus-session>
+  #include <abstractions/dbus-accessibility>
+  #include <abstractions/dri-enumerate>
+  #include <abstractions/mesa>
+  #include <abstractions/ibus>
+  #include <abstractions/nameservice>
+  #include <abstractions/gnome>
 # GnuPG1 only...
-# include <abstractions/gnupg>
-  include <abstractions/python>
-  include <abstractions/p11-kit>
+# #include <abstractions/gnupg>
+  #include <abstractions/python>
+  #include <abstractions/p11-kit>

-  include <abstractions/user-tmp>
+  #include <abstractions/user-tmp>

-  include <abstractions/opencl-intel>
-  include <abstractions/opencl-mesa>
-  include <abstractions/opencl-nvidia>
+  #include <abstractions/opencl-intel>
+  #include <abstractions/opencl-mesa>
+  #include <abstractions/opencl-nvidia>

  #List directories for file browser
  /                                     r,
@ -107,7 +107,7 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
  owner @{libo_user_dirs}/**/           rw,  #allow creating directories that we own
  owner @{libo_user_dirs}/**~lock.*     rw,  #lock file support
  owner @{libo_user_dirs}/**.@{libreoffice_ext} rwk,  #Open files rw with the right exts
-  owner @{libo_user_dirs}/{,**/}lu??????????{,?}.tmp rwk, #Temporary file used when saving
+  owner @{libo_user_dirs}/{,**/}lu???????????{,?}.tmp rwk, #Temporary file used when saving
  owner @{libo_user_dirs}/{,**/}.directory r, #Read directory settings on KDE

  # Settings
@ -214,8 +214,8 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
  owner @{user_share_dirs}/user-places.xbel r,

  # there is abstractions/gnupg but that's just for gpg1...
-  profile gpg flags=(complain) {
-    include <abstractions/base>
+  profile gpg {
+    #include <abstractions/base>

   /usr/bin/gpgconf rm,
   /usr/bin/gpg rm,
--- a/apparmor.d/groups/apt/dpkg-architecture
+++ b/apparmor.d/groups/apt/dpkg-architecture
@ -12,16 +12,21 @@ profile dpkg-architecture @{exec_path} {
  include <abstractions/consoles>
  include <abstractions/perl>

+  capability dac_read_search,
+
  @{exec_path} r,
  /usr/bin/perl r,

  /{usr/,}bin/{,@{multiarch}-}gcc-[0-9]* rix,
+  /{usr/,}lib/llvm-[0-9]*/bin/clang      rix,

  /{usr/,}bin/ccache                     rCx -> ccache,
  /{usr/,}bin/dpkg                       rPx -> child-dpkg,

  /usr/share/dpkg/** r,

+  /etc/debian_version r,
+
  # file_inherit
  owner /tmp/* rw,

@ -31,10 +36,14 @@ profile dpkg-architecture @{exec_path} {

    /{usr/,}bin/ccache mr,

+    /{usr/,}lib/llvm-[0-9]*/bin/clang      rix,
    /{usr/,}bin/{,@{multiarch}-}gcc-[0-9]* rix,
+    /{usr/,}bin/{,@{multiarch}-}g++-[0-9]* rix,

    /media/ccache/*/** rw,

+    /etc/debian_version r,
+
  }

  include if exists <local/dpkg-architecture>
--- a/apparmor.d/groups/browsers/firefox
+++ b/apparmor.d/groups/browsers/firefox
@ -1,5 +1,5 @@
 # apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2015-2020 Mikhail Morfikov
+# Copyright (C) 2015-2021 Mikhail Morfikov
 #               2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only

@ -100,6 +100,12 @@ profile firefox @{exec_path} {
  deny @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
  deny @{sys}/devices/system/cpu/cpu[0-9]/cache/index[0-9]/size r,

+  # For Cryptographic Attestation of Personhood
+  #@{sys}/bus/ r,
+  #@{sys}/class/ r,
+  #@{sys}/class/hidraw/ r,
+  #@{run}/udev/data/c241:[0-9]* r,  # dynamic
+
       owner @{PROC}/@{pid}/fd/ r,
       owner @{PROC}/@{pid}/cgroup r,
  deny owner @{PROC}/@{pid}/stat r,
@ -126,6 +132,7 @@ profile firefox @{exec_path} {

  # Set default browser
  /{usr/,}bin/update-mime-database rPx,
+  owner @{user_config_dirs}/ r,
  owner @{user_config_dirs}/mimeapps.list{,.*} rw,
  owner @{user_share_dirs}/mime/packages/user-extension-{htm,html,xht,xhtml,shtml}.xml rw,
  owner @{user_share_dirs}/mime/packages/user-extension-{htm,html,xht,xhtml,shtml}.xml.* rw,
--- a/apparmor.d/groups/browsers/torbrowser.Tor.tor
+++ b/apparmor.d/groups/browsers/torbrowser.Tor.tor
@ -1,10 +1,10 @@
-include <tunables/global>
-include <tunables/torbrowser>
+#include <tunables/global>
+#include <tunables/torbrowser>

@{torbrowser_tor_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/TorBrowser/Tor/tor

 profile torbrowser_tor @{torbrowser_tor_executable} {
-  include <abstractions/base>
+  #include <abstractions/base>

  network netlink raw,
  network tcp,
@ -24,7 +24,7 @@ profile torbrowser_tor @{torbrowser_tor_executable} {
  # Support some of the included pluggable transports
  owner @{torbrowser_home_dir}/TorBrowser/Tor/PluggableTransports/** rix,
  @{PROC}/sys/net/core/somaxconn r,
-  include <abstractions/ssl_certs>
+  #include <abstractions/ssl_certs>

  # Silence file_inherit logs
  deny @{torbrowser_home_dir}/{browser/,}omni.ja r,
@ -38,6 +38,7 @@ profile torbrowser_tor @{torbrowser_tor_executable} {

  @{PROC}/sys/kernel/random/uuid r,
  /sys/devices/system/cpu/ r,
+  /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,

  # OnionShare compatibility
  /tmp/onionshare/** rw,
--- a/apparmor.d/groups/bus/dbus-daemon
+++ b/apparmor.d/groups/bus/dbus-daemon
@ -22,9 +22,6 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {

  network netlink raw,

-  network bluetooth stream,
-  network bluetooth seqpacket,
-
  ptrace (read) peer=unconfined,

  @{exec_path} mr,
--- a/apparmor.d/groups/gpg/gpg-agent
+++ b/apparmor.d/groups/gpg/gpg-agent
@ -36,6 +36,11 @@ profile gpg-agent @{exec_path} {
  owner /var/lib/*/gnupg/private-keys-v1.d/[0-9A-F]*.key rw,
  owner /var/lib/*/gnupg/S.gpg-agent{,.ssh,.browser,.extra} rw,

+  owner /tmp/tmp.*/gnupg/ rw,
+  owner /tmp/tmp.*/gnupg/private-keys-v1.d/ rw,
+  owner /tmp/tmp.*/gnupg/private-keys-v1.d/[0-9A-F]*.key rw,
+  owner /tmp/tmp.*/gnupg/S.gpg-agent rw,
+
  # For debuild
  owner /tmp/dpkg-import-key.*/private-keys-v1.d/ w,
  owner @{run}/user/@{uid}/gnupg/d.*/S.gpg-agent{,.extra,.browser,.ssh} w,
--- a/apparmor.d/groups/gpg/gpg-connect-agent
+++ b/apparmor.d/groups/gpg/gpg-connect-agent
@ -13,7 +13,18 @@ profile gpg-connect-agent @{exec_path} {

  @{exec_path} mr,

+  /{usr/,}bin/gpg-agent rPx,
+
  /etc/inputrc r,

+  owner @{PROC}/@{pid}/fd/ r,
+
+  owner @{run}/user/@{uid}/gnupg/d.*/ rw,
+
+  owner /tmp/tmp.*/.#lk0x[0-9a-f]*.*.@{pid} rw,
+  owner /tmp/tmp.*/.#lk0x[0-9a-f]*.*.@{pid}x rwl -> /tmp/*/.#lk0x[0-9a-f]*.*.@{pid},
+  owner /tmp/tmp.*/gnupg_spawn_agent_sentinel.lock rwl -> /tmp/*/.#lk0x[0-9a-f]*.*.@{pid},
+
  include if exists <local/gpg-connect-agent>
 }
+
--- a/apparmor.d/profiles-a-l/anki
+++ b/apparmor.d/profiles-a-l/anki
@ -20,6 +20,7 @@ profile anki @{exec_path} {
  include <abstractions/mesa>
  include <abstractions/qt5-settings-write>
  include <abstractions/qt5-compose-cache-write>
+  include <abstractions/qt5-shader-cache>
  include <abstractions/user-download-strict>
  include <abstractions/trash>
  include <abstractions/openssl>
@ -28,6 +29,12 @@ profile anki @{exec_path} {

  signal (send) set=(term, kill) peer=anki//mpv,

+  network inet dgram,
+  network inet6 dgram,
+  network inet stream,
+  network inet6 stream,
+  network netlink raw,
+
  @{exec_path} r,
  /{usr/,}bin/python3.[0-9]* r,

@ -57,9 +64,15 @@ profile anki @{exec_path} {

  /usr/share/javascript/**/*.js r,

+  owner @{user_cache_dirs}/Anki/ rw,
+  owner @{user_cache_dirs}/Anki/** rw,
+
  owner @{user_share_dirs}/Anki{,2}/ rw,
  owner @{user_share_dirs}/Anki{,2}/** rwk,

+  owner @{HOME}/ r,
+  owner @{HOME}/.cache/ rw,
+
  # To remove the following error:
  #  Error initializing NSS with a persistent database
  owner @{HOME}/.pki/ rw,
@ -78,10 +91,13 @@ profile anki @{exec_path} {
  #  [:FATAL:sandbox_linux.cc(172)] Check failed: proc_fd_ >= 0 (-1 vs. 0)
             @{PROC}/ r,
       owner @{PROC}/@{pid}/fd/ r,
-  deny owner @{PROC}/@{pid}/mem r,
+       owner @{PROC}/@{pid}/mem r,
+       owner @{PROC}/@{pids}/statm r,
+       owner @{PROC}/@{pids}/stat r,
       owner @{PROC}/@{pid}/task/ r,
       owner @{PROC}/@{pid}/task/@{tid}/status r,
             @{PROC}/sys/kernel/yama/ptrace_scope r,
+             @{PROC}/sys/fs/inotify/max_user_watches r,
  deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
  deny owner @{PROC}/@{pid}/cmdline r,
  # To remove the following error:
@ -90,7 +106,7 @@ profile anki @{exec_path} {
       owner @{PROC}/@{pid}/mountinfo r,
       owner @{PROC}/@{pid}/mounts r,
  deny       @{PROC}/sys/kernel/random/boot_id r,
-  deny       @{PROC}/vmstat r,
+             @{PROC}/vmstat r,
  deny owner @{PROC}/@{pid}/setgroups w,

  /etc/fstab r,
--- a/apparmor.d/profiles-a-l/arduino-builder
+++ b/apparmor.d/profiles-a-l/arduino-builder
@ -23,6 +23,7 @@ profile arduino-builder @{exec_path} {
  /{usr/,}lib/gcc/avr/[0-9]*/collect2    rix,
  /{usr/,}lib/gcc/avr/[0-9]*/lto-wrapper rix,
  /{usr/,}lib/gcc/avr/[0-9]*/lto1        rix,
+  /{usr/,}lib/llvm-[0-9]*/bin/clang      rix,
  /{usr/,}lib/avr/bin/as                 rix,
  /{usr/,}lib/avr/bin/ar                 rix,
  /{usr/,}lib/avr/bin/ld                 rix,
--- a/apparmor.d/profiles-a-l/borg
+++ b/apparmor.d/profiles-a-l/borg
@ -92,10 +92,14 @@ profile borg @{exec_path} {

    /{usr/,}bin/ccache mr,

+    /{usr/,}lib/llvm-[0-9]*/bin/clang      rix,
    /{usr/,}bin/{,@{multiarch}-}gcc-[0-9]* rix,
+    /{usr/,}bin/{,@{multiarch}-}g++-[0-9]* rix,

    /media/ccache/*/** rw,

+    /etc/debian_version r,
+
  }

  profile fusermount {
--- a/apparmor.d/profiles-a-l/dkms
+++ b/apparmor.d/profiles-a-l/dkms
@ -49,6 +49,7 @@ profile dkms @{exec_path} {
  /{usr/,}bin/make                             rix,
  /{usr/,}bin/{,@{multiarch}-}*                rix,
  /{usr/,}lib/gcc/@{multiarch}/[0-9]*/*        rix,
+  /{usr/,}lib/llvm-[0-9]*/bin/clang            rix,

  /{usr/,}bin/kmod        rCx -> kmod,
  /{usr/,}bin/lsb_release rPx -> child-lsb_release,
@ -70,6 +71,7 @@ profile dkms @{exec_path} {
  /etc/dkms/{,**} r,

  # For building module in /usr/src/ subdirs
+  /usr/src/ r,
  /usr/src/** rw,
  /usr/src/linux-headers-*/scripts/gcc-plugins/*.so mr,
  /usr/src/linux-headers-*/scripts/**              rix,
--- a/apparmor.d/profiles-a-l/exim4
+++ b/apparmor.d/profiles-a-l/exim4
@ -53,22 +53,25 @@ profile exim4 @{exec_path} {
  /etc/email-addresses r,
  /etc/aliases r,

-  deny /var/log/exim4/ w,
+  /var/log/exim4/ w,
  /var/log/exim4/mainlog w,
  /var/log/exim4/paniclog w,
+  /var/log/exim4/rejectlog w,

-  owner /var/spool/exim4/ r,
+        /var/spool/exim4/ r,
        /var/spool/exim4/input/ r,
        /var/spool/exim4/input/*-*-*-* rwk,
  owner /var/spool/exim4/input/hdr.*-*-* rw,
  owner /var/spool/exim4/input/hdr.@{pid} rw,
        /var/spool/exim4/db/retry.lockfile rwk,
+  owner /var/spool/exim4/db/__db.retry rwk,
        /var/spool/exim4/msglog/*-*-* w,

  owner /var/mail/* rwk,
  owner /var/mail/*.lock.*.[0-9a-f]*.[0-9a-f]* w,
  owner /var/mail/*.lock wl -> /var/mail/*.lock.*.[0-9a-f]*.[0-9a-f]*,

+        @{run}/exim4/ r,
  owner @{run}/exim4/exim.pid rw,

  owner @{run}/dbus/system_bus_socket rw,
--- a/apparmor.d/profiles-a-l/hardinfo
+++ b/apparmor.d/profiles-a-l/hardinfo
@ -126,10 +126,14 @@ profile hardinfo @{exec_path} {

    /{usr/,}bin/ccache mr,

+    /{usr/,}lib/llvm-[0-9]*/bin/clang      rix,
    /{usr/,}bin/{,@{multiarch}-}gcc-[0-9]* rix,
+    /{usr/,}bin/{,@{multiarch}-}g++-[0-9]* rix,

    /media/ccache/*/** rw,

+    /etc/debian_version r,
+
  }

  profile javac {
--- a/apparmor.d/profiles-a-l/inxi
+++ b/apparmor.d/profiles-a-l/inxi
@ -27,10 +27,12 @@ profile inxi @{exec_path} {
  /{usr/,}bin/zsh        rix,
  /{usr/,}bin/tty        rix,
  /{usr/,}bin/tput       rix,
-  /{usr/,}bin/{,@{multiarch}-}gcc-[0-9]* rix,
  /{usr/,}bin/getconf    rix,
  /{usr/,}bin/file       rix,

+  /{usr/,}lib/llvm-[0-9]*/bin/clang      rix,
+  /{usr/,}bin/{,@{multiarch}-}gcc-[0-9]* rix,
+
  /{usr/,}bin/ip              rCx -> ip,
  /{usr/,}lib/systemd/systemd rCx -> systemd,
  /{usr/,}bin/kmod            rCx -> kmod,
--- a/apparmor.d/profiles-a-l/kscreenlocker-greet
+++ b/apparmor.d/profiles-a-l/kscreenlocker-greet
@ -16,6 +16,7 @@ profile kscreenlocker-greet @{exec_path} {
  include <abstractions/dri-enumerate>
  include <abstractions/mesa>
  include <abstractions/qt5-compose-cache-write>
+  include <abstractions/qt5-shader-cache>
  include <abstractions/nameservice-strict>
  include <abstractions/deny-root-dir-access>

--- a/apparmor.d/profiles-m-z/merkaartor
+++ b/apparmor.d/profiles-m-z/merkaartor
@ -0,0 +1,62 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2021 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/merkaartor
+profile merkaartor @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/gtk>
+  include <abstractions/fonts>
+  include <abstractions/fontconfig-cache-read>
+  include <abstractions/freedesktop.org>
+  include <abstractions/mesa>
+  include <abstractions/dri-common>
+  include <abstractions/dri-enumerate>
+  include <abstractions/qt5-settings-write>
+  include <abstractions/nameservice-strict>
+  include <abstractions/ssl_certs>
+  include <abstractions/openssl>
+  include <abstractions/user-download-strict>
+
+  network inet dgram,
+  network inet6 dgram,
+  network inet stream,
+  network inet6 stream,
+  network netlink dgram,
+  network netlink raw,
+
+  @{exec_path} mr,
+
+  /usr/share/merkaartor/{,**} r,
+
+  owner @{HOME}/.config/Merkaartor/ rw,
+  owner @{HOME}/.config/Merkaartor/* rwkl -> @{HOME}/.config/Merkaartor/,
+
+  owner @{HOME}/.merkaartor/ rw,
+  owner @{HOME}/.merkaartor/* rw,
+
+  owner @{HOME}/merkaartor.log rw,
+
+  /var/lib/dbus/machine-id r,
+  /etc/machine-id r,
+
+  # To configure Qt5 settings (theme, font, icons, etc.) under DE/WM without Qt integration
+  owner @{HOME}/.config/qt5ct/{,**} r,
+  /usr/share/qt5ct/** r,
+
+  /usr/share/hwdata/pnp.ids r,
+
+  deny owner @{PROC}/@{pid}/cmdline r,
+
+  owner /tmp/qtsingleapp-merkaa-* rw,
+  owner /tmp/qtsingleapp-merkaa-*-lockfile rwk,
+
+  @{sys}/devices/system/node/ r,
+  @{sys}/devices/system/node/node[0-9]*/meminfo r,
+
+  include if exists <local/merkaartor>
+}
--- a/apparmor.d/profiles-m-z/minitube
+++ b/apparmor.d/profiles-m-z/minitube
@ -17,10 +17,10 @@ profile minitube @{exec_path} {
  include <abstractions/freedesktop.org>
  include <abstractions/mesa>
  include <abstractions/audio>
-  include <abstractions/qt5-compose-cache-write>
  include <abstractions/nameservice-strict>
  include <abstractions/qt5-settings-write>
  include <abstractions/qt5-compose-cache-write>
+  include <abstractions/qt5-shader-cache>
  include <abstractions/openssl>
  include <abstractions/ssl_certs>
  include <abstractions/deny-root-dir-access>
--- a/apparmor.d/profiles-m-z/pinentry-kwallet
+++ b/apparmor.d/profiles-m-z/pinentry-kwallet
@ -11,7 +11,6 @@ profile pinentry-kwallet @{exec_path} {
  include <abstractions/base>
  include <abstractions/consoles>
  include <abstractions/freedesktop.org>
-  include <abstractions/deny-root-dir-access>

  signal (send) set=(term, kill) peer=gpg-agent,

--- a/apparmor.d/profiles-m-z/pinentry-qt
+++ b/apparmor.d/profiles-m-z/pinentry-qt
@ -18,7 +18,6 @@ profile pinentry-qt @{exec_path} {
  include <abstractions/mesa>
  include <abstractions/nameservice-strict>
  include <abstractions/qt5-compose-cache-write>
-  include <abstractions/deny-root-dir-access>

  @{exec_path} mr,

--- a/apparmor.d/profiles-m-z/pipewire
+++ b/apparmor.d/profiles-m-z/pipewire
@ -0,0 +1,49 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2015-2020 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/pipewire
+profile pipewire @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/nameservice-strict>
+
+  ptrace (read) peer=pipewire-media-session,
+  ptrace (read) peer=pipewire-pulse,
+
+  # Needed for all sound/music apps.
+  ptrace (read),
+
+  @{exec_path} mr,
+
+  /etc/pipewire/pipewire.conf r,
+  /etc/pipewire/client.conf r,
+
+  owner @{run}/user/@{uid}/pipewire-[0-9]*.lock rwk,
+
+  /dev/snd/controlC[0-9]* rw,
+  /dev/snd/pcmC[0-9]*D[0-9]*p rw,
+  /dev/snd/pcmC[0-9]*D[0-9]*c rw,
+
+  /usr/share/alsa/{,**} r,
+  /etc/alsa/{,**} r,
+
+  /dev/shm/ r,
+  @{run}/shm/ r,
+  /etc/pulse/{,**} r,
+  owner @{HOME}/.config/pulse/ rw,
+  owner @{HOME}/.config/pulse/cookie rwk,
+  owner @{run}/user/@{uid}/pulse/ r,
+
+  @{sys}/devices/virtual/dmi/id/product_name r,
+  @{sys}/devices/virtual/dmi/id/sys_vendor r,
+  @{sys}/devices/virtual/dmi/id/board_vendor r,
+  @{sys}/devices/virtual/dmi/id/bios_vendor r,
+
+  / r,
+
+  include if exists <local/pipewire>
+}
--- a/apparmor.d/profiles-m-z/pipewire-media-session
+++ b/apparmor.d/profiles-m-z/pipewire-media-session
@ -0,0 +1,54 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2015-2020 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/pipewire-media-session
+profile pipewire-media-session @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/nameservice-strict>
+
+  network netlink raw,
+
+  @{exec_path} mr,
+
+  /etc/pipewire/media-session.d/*.conf r,
+
+  owner @{HOME}/.config/pipewire/ rw,
+  owner @{HOME}/.config/pipewire/** rw,
+
+  /dev/snd/controlC[0-9]* rw,
+  /dev/snd/pcmC[0-9]*D[0-9]*p rw,
+  /dev/snd/pcmC[0-9]*D[0-9]*c rw,
+
+  /usr/share/alsa-card-profile/{,**} r,
+  /usr/share/alsa/{,**} r,
+  /etc/alsa/{,**} r,
+
+  /dev/shm/ r,
+  @{run}/shm/ r,
+  /etc/pulse/{,**} r,
+  owner @{HOME}/.config/pulse/ rw,
+  owner @{HOME}/.config/pulse/cookie rwk,
+  owner @{run}/user/@{uid}/pulse/ rw,
+
+  @{sys}/bus/ r,
+  @{sys}/class/ r,
+  @{sys}/class/sound/ r,
+  @{sys}/class/video4linux/ r,
+
+  @{sys}/devices/**/sound/**/uevent r,
+
+  @{run}/udev/data/+sound:card[0-9]* r, # For sound
+  @{run}/udev/data/c116:[0-9]* r,       # For ALSA
+
+  @{run}/systemd/users/@{uid} r,
+
+  @{sys}/devices/system/node/ r,
+  @{sys}/devices/system/node/node[0-9]*/meminfo r,
+
+  include if exists <local/pipewire-media-session>
+}
--- a/apparmor.d/profiles-m-z/pipewire-pulse
+++ b/apparmor.d/profiles-m-z/pipewire-pulse
@ -0,0 +1,36 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2015-2020 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/pipewire-pulse
+profile pipewire-pulse @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/nameservice-strict>
+
+  ptrace (read) peer=pipewire,
+  ptrace (read) peer=pipewire-media-session,
+
+  # Needed for all sound/music apps.
+  ptrace (read),
+
+  @{exec_path} mr,
+
+  /etc/pipewire/client.conf r,
+
+  /etc/pipewire/pipewire-pulse.conf r,
+
+  owner @{run}/user/@{uid}/pulse/pid w,
+
+  @{sys}/devices/virtual/dmi/id/product_name r,
+  @{sys}/devices/virtual/dmi/id/sys_vendor r,
+  @{sys}/devices/virtual/dmi/id/board_vendor r,
+  @{sys}/devices/virtual/dmi/id/bios_vendor r,
+
+  / r,
+
+  include if exists <local/pipewire-pulse>
+}
--- a/apparmor.d/profiles-m-z/polkitd
+++ b/apparmor.d/profiles-m-z/polkitd
@ -30,21 +30,22 @@ profile polkitd @{exec_path} {
  @{PROC}/cmdline r,

  # System rules
-  /etc/polkit-1/rules.d/{,[0-9][0-9]-*.rules} r,
+  /etc/polkit-1/rules.d/ r,
+  /etc/polkit-1/rules.d/[0-9][0-9]-*.rules r,

  # Vendor rules
-  /usr/share/polkit-1/rules.d/{,*.rules} r,
+  /usr/share/polkit-1/rules.d/ r,
+  /usr/share/polkit-1/rules.d/*.rules r,

  # Vendor policies
-  /usr/share/polkit-1/actions/{,*.policy} r,
+  /usr/share/polkit-1/actions/ r,
+  /usr/share/polkit-1/actions/*.policy r,
+  /usr/share/polkit-1/actions/*.policy.choice r,

  owner /var/lib/polkit-1/.cache/ rw,

  @{run}/systemd/sessions/* r,
  @{run}/systemd/users/@{uid} r,

-  # Silencer
-  deny /.cache/ rw,
-
  include if exists <local/polkitd>
 }
--- a/apparmor.d/profiles-m-z/pulseeffects
+++ b/apparmor.d/profiles-m-z/pulseeffects
@ -0,0 +1,44 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2015-2020 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/pulseeffects
+profile pulseeffects @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/gtk>
+  include <abstractions/fonts>
+  include <abstractions/fontconfig-cache-read>
+  include <abstractions/freedesktop.org>
+  include <abstractions/nameservice-strict>
+  include <abstractions/gstreamer>
+
+  network netlink raw,
+
+  @{exec_path} mr,
+
+  /etc/pipewire/pipewire.conf r,
+  /etc/pipewire/client.conf r,
+
+  owner @{HOME}/.config/PulseEffects/ rw,
+  owner @{HOME}/.config/PulseEffects/** rw,
+
+  owner @{HOME}/.config/autostart/pulseeffects-service.desktop w,
+
+  owner @{PROC}/@{pid}/cmdline r,
+  owner @{PROC}/@{pid}/fd/ r,
+
+  /usr/share/glib-2.0/schemas/gschemas.compiled r,
+
+  include <abstractions/dconf>
+  owner @{run}/user/@{uid}/dconf/ rw,
+  owner @{run}/user/@{uid}/dconf/user rw,
+
+  # file_inherit
+  owner /dev/tty[0-9]* rw,
+
+  include if exists <local/pulseeffects>
+}
--- a/apparmor.d/profiles-m-z/rpi-imager
+++ b/apparmor.d/profiles-m-z/rpi-imager
@ -19,6 +19,7 @@ profile rpi-imager @{exec_path} {
  include <abstractions/ssl_certs>
  include <abstractions/openssl>
  include <abstractions/mesa>
+  include <abstractions/qt5-shader-cache>
  include <abstractions/user-download-strict>
  include <abstractions/disks-write>

@ -28,7 +29,7 @@ profile rpi-imager @{exec_path} {
  network inet dgram,
  network inet6 dgram,
  network inet stream,
-  network inet6 stream, 
+  network inet6 stream,
  network netlink dgram,
  network netlink raw,

--- a/apparmor.d/profiles-m-z/sddm-greeter
+++ b/apparmor.d/profiles-m-z/sddm-greeter
@ -14,6 +14,7 @@ profile sddm-greeter @{exec_path} {
  include <abstractions/fonts>
  include <abstractions/fontconfig-cache-read>
  include <abstractions/mesa>
+  include <abstractions/qt5-shader-cache>
  include <abstractions/nameservice-strict>

  @{exec_path} mr,
--- a/apparmor.d/profiles-m-z/spectre-meltdown-checker
+++ b/apparmor.d/profiles-m-z/spectre-meltdown-checker
@ -104,10 +104,14 @@ profile spectre-meltdown-checker @{exec_path} {

    /{usr/,}bin/ccache mr,

+    /{usr/,}lib/llvm-[0-9]*/bin/clang      rix,
    /{usr/,}bin/{,@{multiarch}-}gcc-[0-9]* rix,
+    /{usr/,}bin/{,@{multiarch}-}g++-[0-9]* rix,

    /media/ccache/*/** rw,

+    /etc/debian_version r,
+
  }

  profile pgrep {
--- a/apparmor.d/profiles-m-z/thermald
+++ b/apparmor.d/profiles-m-z/thermald
@ -0,0 +1,54 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2015-2020 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}sbin/thermald
+profile thermald @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  owner @{run}/thermald/ rw,
+  owner @{run}/thermald/thd_preference.conf rw,
+  owner @{run}/thermald/thd_preference.conf.save w,
+  owner @{run}/thermald/thermald.pid rwk,
+
+  /etc/thermald/thermal-conf.xml r,
+  /etc/thermald/thermal-cpu-cdev-order.xml r,
+
+  @{sys}/class/hwmon/ r,
+  @{sys}/class/thermal/ r,
+  @{sys}/devices/platform/ r,
+
+  @{sys}/devices/system/cpu/present r,
+  @{sys}/devices/system/cpu/intel_pstate/max_perf_pct r,
+  @{sys}/devices/system/cpu/intel_pstate/status r,
+
+  @{sys}/devices/pci[0-9]*/**/drm/**/intel_backlight/max_brightness r,
+
+  @{sys}/devices/**/hwmon[0-9]*/name r,
+  @{sys}/devices/**/hwmon[0-9]*/temp[0-9]*_{max,crit} r,
+
+  @{sys}/devices/virtual/dmi/id/product_name r,
+  @{sys}/devices/virtual/dmi/id/product_uuid r,
+
+  @{sys}/devices/virtual/thermal/**/{type,temp} r,
+
+  @{sys}/devices/virtual/thermal/thermal_zone[0-9]*/ r,
+  @{sys}/devices/virtual/thermal/thermal_zone[0-9]*/trip_point_[0-9]*_temp rw,
+  @{sys}/devices/virtual/thermal/thermal_zone[0-9]*/trip_point_[0-9]*_type r,
+
+  @{sys}/devices/virtual/thermal/cooling_device[0-9]*/cur_state rw,
+  @{sys}/devices/virtual/thermal/cooling_device[0-9]*/max_state r,
+
+  @{sys}/devices/virtual/powercap/intel-rapl/ r,
+  @{sys}/devices/virtual/powercap/intel-rapl/**/name r,
+  @{sys}/devices/virtual/powercap/intel-rapl/intel-rapl:[0-9]*/ r,
+  @{sys}/devices/virtual/powercap/intel-rapl/intel-rapl:[0-9]*/* r,
+
+  include if exists <local/thermald>
+}
--- a/apparmor.d/profiles-m-z/vidcutter
+++ b/apparmor.d/profiles-m-z/vidcutter
@ -43,6 +43,7 @@ profile vidcutter @{exec_path} {
  include <abstractions/mesa>
  include <abstractions/qt5-settings-write>
  include <abstractions/qt5-compose-cache-write>
+  include <abstractions/qt5-shader-cache>
  include <abstractions/user-download-strict>
  include <abstractions/audio>
  include <abstractions/nameservice-strict>
--- a/apparmor.d/profiles-m-z/volumeicon
+++ b/apparmor.d/profiles-m-z/volumeicon
@ -36,8 +36,9 @@ profile volumeicon @{exec_path} {
  /usr/share/glib-2.0/schemas/gschemas.compiled r,

  # Start the PulseAudio sound mixer
-  /{usr/,}bin/{,ba,da}sh   rix,
-  /{usr/,}bin/pavucontrol rPUx,
+  /{usr/,}bin/{,ba,da}sh    rix,
+  /{usr/,}bin/pavucontrol  rPUx,
+  /{usr/,}bin/pulseeffects rPUx,

  # file_inherit
  owner /dev/tty[0-9]* rw,
--- a/apparmor.d/profiles-m-z/xdg-mime
+++ b/apparmor.d/profiles-m-z/xdg-mime
@ -47,8 +47,6 @@ profile xdg-mime @{exec_path} {

  owner @{run}/user/@{uid}/ r,

-  /dev/tty rw,
-
  # For shell pwd
  owner @{HOME}/ r,

--- a/apparmor.d/profiles-m-z/xrdb
+++ b/apparmor.d/profiles-m-z/xrdb
@ -16,6 +16,7 @@ profile xrdb @{exec_path} {
  /{usr/,}bin/{,ba,da}sh                  rix,
  /{usr/,}bin/{,@{multiarch}-}cpp-[0-9]*  rix,
  /{usr/,}lib/gcc/@{multiarch}/[0-9]*/cc1 rix,
+  /{usr/,}lib/llvm-[0-9]*/bin/clang       rix,
  /usr/include/stdc-predef.h r,

  owner @{HOME}/.Xauthority r,
--- a/apparmor.d/profiles-m-z/youtube-dl
+++ b/apparmor.d/profiles-m-z/youtube-dl
@ -65,7 +65,8 @@ profile youtube-dl @{exec_path} {
  /{usr/,}bin/python3.[0-9]* r,

  /{usr/,}bin/ r,
-  /{usr/,}bin/gcc            rix,
+  /{usr/,}bin/{,@{multiarch}-}gcc-[0-9]* rix,
+  /{usr/,}lib/llvm-[0-9]*/bin/clang      rix,
  /{usr/,}{s,}bin/ldconfig      rix,
  /{usr/,}bin/uname          rix,
  /{usr/,}bin/rtmpdump       rix,