From e4266d9cda435d9c3f3e101c332b9218a433c836 Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Fri, 2 Apr 2021 10:11:59 +0100
Subject: [PATCH] Some rules addition for gnome support.

---
 apparmor.d/groups/desktop/accounts-daemon     | 1 +
 apparmor.d/groups/desktop/at-spi-bus-launcher | 8 ++++++++
 apparmor.d/groups/desktop/at-spi2-registryd   | 1 +
 apparmor.d/groups/desktop/blueman             | 9 +++++++--
 apparmor.d/groups/desktop/bluetoothd          | 1 +
 apparmor.d/groups/desktop/colord              | 9 ++++++++-
 6 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/apparmor.d/groups/desktop/accounts-daemon b/apparmor.d/groups/desktop/accounts-daemon
index 0553f410..4eb87fdb 100644
--- a/apparmor.d/groups/desktop/accounts-daemon
+++ b/apparmor.d/groups/desktop/accounts-daemon
@@ -25,6 +25,7 @@ profile accounts-daemon @{exec_path} {
 
   /usr/share/dbus-1/interfaces/org.freedesktop.DisplayManager.AccountsService.xml r,
 
+  /etc/gdm/custom.conf r,
   /etc/shells r,
   /etc/shadow r,
 
diff --git a/apparmor.d/groups/desktop/at-spi-bus-launcher b/apparmor.d/groups/desktop/at-spi-bus-launcher
index 36bd5342..e328b804 100644
--- a/apparmor.d/groups/desktop/at-spi-bus-launcher
+++ b/apparmor.d/groups/desktop/at-spi-bus-launcher
@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2018-2021 Mikhail Morfikov
+#               2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -26,20 +27,27 @@ profile at-spi-bus-launcher @{exec_path} {
   /{usr/,}bin/dbus-daemon rPUx,
 
   owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/cgroup r,
 
   owner @{HOME}/.Xauthority r,
   /var/lib/lightdm/.Xauthority r,
+  @{run}/user/[0-9]*/gdm/Xauthority r,
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
   include <abstractions/dconf>
   owner @{run}/user/[0-9]*/dconf/ rw,
   owner @{run}/user/[0-9]*/dconf/user rw,
+  /usr/share/dconf/profile/gdm r,
+  /var/lib/gdm/.config/dconf/user r,
 
   # file_inherit
   owner /dev/tty[0-9]* rw,
   owner @{HOME}/.xsession-errors w,
   /var/log/lightdm/seat[0-9]*-greeter.log w,
+  /usr/share/gdm/greeter-dconf-defaults r,
+
+  @{PROC}/1/cgroup r,
 
   include if exists <local/at-spi-bus-launcher>
 }
diff --git a/apparmor.d/groups/desktop/at-spi2-registryd b/apparmor.d/groups/desktop/at-spi2-registryd
index 566c46cb..4be51c7b 100644
--- a/apparmor.d/groups/desktop/at-spi2-registryd
+++ b/apparmor.d/groups/desktop/at-spi2-registryd
@@ -20,6 +20,7 @@ profile at-spi2-registryd @{exec_path} {
 
   owner @{HOME}/.Xauthority r,
   /var/lib/lightdm/.Xauthority r,
+  @{run}/user/[0-9]*/gdm/Xauthority r,
 
   # file_inherit
   owner @{HOME}/.xsession-errors w,
diff --git a/apparmor.d/groups/desktop/blueman b/apparmor.d/groups/desktop/blueman
index 0b3c7dc4..9f9f7a92 100644
--- a/apparmor.d/groups/desktop/blueman
+++ b/apparmor.d/groups/desktop/blueman
@@ -23,11 +23,13 @@ profile blueman @{exec_path} {
 
   network bluetooth raw,
 
+  ptrace (read) peer=gjs-console,
   @{exec_path} mrix,
   /{usr/,}bin/python3.[0-9]* r,
+  /{usr/,}bin/blueman-tray rPx,
 
   /{usr/,}bin/         r,
-  /{usr/,}bin/dash     rix,
+  /{usr/,}bin/{b,d}ash rix,
 
   /{usr/,}bin/xdg-open rCx -> open,
 
@@ -63,6 +65,8 @@ profile blueman @{exec_path} {
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
+  /dev/tty rw,
+
   /dev/rfkill r,
 
   /dev/shm/ r,
@@ -70,8 +74,9 @@ profile blueman @{exec_path} {
   /var/lib/dbus/machine-id r,
   /etc/machine-id r,
 
+  @{run}/user/1000/gdm/Xauthority r,
 
-    profile open {
+  profile open {
     include <abstractions/base>
     include <abstractions/xdg-open>
 
diff --git a/apparmor.d/groups/desktop/bluetoothd b/apparmor.d/groups/desktop/bluetoothd
index 8209d16d..f79d9167 100644
--- a/apparmor.d/groups/desktop/bluetoothd
+++ b/apparmor.d/groups/desktop/bluetoothd
@@ -27,6 +27,7 @@ profile bluetoothd @{exec_path} {
 
   /etc/bluetooth/{,*.conf} r,
 
+  /dev/uhid rw,
   /dev/uinput rw,
   /dev/rfkill rw,
   /dev/hidraw[0-9]* rw,
diff --git a/apparmor.d/groups/desktop/colord b/apparmor.d/groups/desktop/colord
index 88a48d63..cc9e8ee1 100644
--- a/apparmor.d/groups/desktop/colord
+++ b/apparmor.d/groups/desktop/colord
@@ -23,14 +23,17 @@ profile colord @{exec_path} flags=(attach_disconnected) {
   owner /var/lib/colord/.cache/ rw,
   owner /var/lib/colord/.cache/** rw,
   owner /var/lib/colord/{mapping,storage}.db rwk,
+  /var/lib/gdm/.local/share/icc/edid-*.icc r,
 
   /etc/udev/hwdb.bin r,
 
   /usr/share/color/icc/{,**} r,
 
+  owner /run/systemd/sessions/1 r,
+
   @{sys}/class/drm/ r,
   @{sys}/class/video4linux/ r,
-  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]/card[0-9]-{HDMI,VGA,LVDS,DP}-*/{enabled,edid} r,
+  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]/card[0-9]-{HDMI,VGA,LVDS,DP,eDP}-*/{enabled,edid} r,
   @{sys}/devices/virtual/dmi/id/{sys_vendor,product_version,product_name} r,
 
   owner @{PROC}/@{pid}/fd/ r,
@@ -39,5 +42,9 @@ profile colord @{exec_path} flags=(attach_disconnected) {
 
   /usr/share/mime/mime.cache r,
 
+  @{user_share_dirs}/icc/edid-*.icc r,
+
+  /run/systemd/sessions/1 r,
+
   include if exists <local/colord>
 }