Minor fixes.

apparmor.d/groups/desktop/at-spi2-registryd

@@ -8,7 +8,7 @@ include <tunables/global>
 
 @{exec_path}  = /{usr/,}lib/at-spi2-core/at-spi2-registryd
 @{exec_path} += /usr/{lib,libexec}/at-spi2-registryd
-profile at-spi2-registryd @{exec_path} {
+profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
   include <abstractions/deny-root-dir-access>

apparmor.d/groups/desktop/dbus-run-session

@@ -28,7 +28,9 @@ profile dbus-run-session @{exec_path} {
   /usr/share/dconf/profile/gdm r,
   /var/lib/gdm/.config/dconf/user r,
 
-  /dev/tty rw,
+  # file_inherit
+  owner /dev/tty rw,
+  owner /dev/tty[0-9]* rw,
 
   include if exists <local/dbus-run-session>
 }

apparmor.d/groups/gnome/gdm-wayland-session

@@ -43,5 +43,8 @@ profile gdm-wayland-session @{exec_path} {
   owner @{run}/user/[0-9]*/dconf/ rw,
   owner @{run}/user/[0-9]*/dconf/user rw,
 
+  # file_inherit
+  /dev/tty[0-9]* rw,
+
   include if exists <local/gdm-wayland-session>
 }

apparmor.d/groups/gnome/gnome-session-binary

@@ -80,6 +80,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
 
   /dev/null r,
   /dev/tty rw,
+  /dev/tty[0-9]* rw,
 
   include if exists <local/gnome-session-binary>
 }

apparmor.d/groups/gnome/gnome-shell

@@ -12,6 +12,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   include <abstractions/app-launcher-user>
   include <abstractions/audio>
   include <abstractions/dri-common>
+  include <abstractions/dri-enumerate>
   include <abstractions/gnome>
   include <abstractions/mesa>
   include <abstractions/nameservice-strict>
@@ -117,8 +118,6 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   @{sys}/devices/**/hwmon[0-9]*/{,name,temp*,fan*} r,
   @{sys}/devices/**/hwmon[0-9]*/**/{,name,temp*,fan*} r,
   @{sys}/devices/pci[0-9]*/**/boot_vga r,
-  @{sys}/devices/pci[0-9]*/**/{device,vendor} r,
-  @{sys}/devices/pci[0-9]*/**/{subsystem_device,subsystem_vendor} r,
   @{sys}/devices/pci[0-9]*/**/input[0-9]*/{properties,name} r,
   @{sys}/devices/pci[0-9]*/**/net/*/statistics/{rx_bytes,tx_bytes} r,
 

apparmor.d/groups/ssh/ssh

@@ -31,6 +31,7 @@ profile ssh @{exec_path} {
   owner @{HOME}/@{XDG_SSH_DIR}/known_hosts r,
   owner @{HOME}/@{XDG_SSH_DIR}/*_*{,.pub} r,
   owner @{HOME}/@{XDG_PROJECTS_DIR}/**/ssh/{,*} r,
+  owner @{HOME}/@{XDG_PROJECTS_DIR}/**/config r,
 
   /etc/ssh/ssh_config r,
   /etc/ssh/ssh_config.d/ r,

apparmor.d/groups/ssh/ssh-agent

@@ -12,6 +12,8 @@ profile ssh-agent @{exec_path} {
   include <abstractions/base>
   include <abstractions/openssl>
 
+  signal (receive) set=term peer=gnome-keyring-daemon,
+
   @{exec_path} mr,
 
   owner /tmp/ssh-*/ rw,

apparmor.d/groups/systemd/systemd-coredump

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2021 Mikhail Morfikov
+#               2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -9,7 +10,9 @@ include <tunables/global>
 @{exec_path}  = /{usr/,}lib/systemd/systemd-coredump
 profile systemd-coredump @{exec_path} flags=(complain) {
   include <abstractions/base>
+  include <abstractions/openssl>
   include <abstractions/systemd-common>
+  include <abstractions/nameservice-strict>
 
   capability setpcap,
   capability setuid,

apparmor.d/groups/systemd/systemd-logind

@@ -50,7 +50,7 @@ profile systemd-logind @{exec_path} flags=(complain) {
 
   @{run}/systemd/seats/ r,
   @{run}/systemd/seats/.#seat* rw,
-  @{run}/systemd/seats/seat0 rw,
+  @{run}/systemd/seats/seat[0-9]* rw,
   @{run}/systemd/inhibit/ r,
   @{run}/systemd/inhibit/[0-9]*{,.ref} rw,
   @{run}/systemd/inhibit/.#* rw,

apparmor.d/profiles-m-z/polkitd

@@ -43,5 +43,8 @@ profile polkitd @{exec_path} {
   @{run}/systemd/sessions/* r,
   @{run}/systemd/users/[0-9]* r,
 
+  # Silencer
+  deny /.cache/ rw,
+
   include if exists <local/polkitd>
 }