feat(profile): general update.

apparmor.d/groups/gnome/gio-launch-desktop

@@ -15,6 +15,7 @@ profile gio-launch-desktop @{exec_path} flags=(attach_disconnected) {
   include <abstractions/app-launcher-user>
   include <abstractions/consoles>
   include <abstractions/gnome-strict>
+  include <abstractions/trash>
 
   @{exec_path} mr,
 

apparmor.d/groups/ssh/ssh-agent

@@ -25,6 +25,7 @@ profile ssh-agent @{exec_path} {
   @{bin}/kwalletaskpass       rPUx,
   @{bin}/openbox-session       rPx,
   @{bin}/startkde             rPUx,
+  @{bin}/startxfce4           rPUx,
   @{bin}/sway                 rPUx,
 
   owner @{HOME}/@{XDG_SSH_DIR}/ rw,

apparmor.d/groups/systemd/systemd-socket-proxyd

@@ -0,0 +1,22 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{lib}/systemd/systemd-socket-proxyd
+profile systemd-socket-proxyd @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/systemd-common>
+
+  capability net_admin,
+
+  network inet stream,
+  network inet6 stream,
+
+  @{exec_path} mr,
+
+  include if exists <local/systemd-socket-proxyd>
+}

apparmor.d/profiles-a-f/flatpak

@@ -60,7 +60,8 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
   owner @{user_config_dirs}/user-dirs.dirs r,
 
         @{user_share_dirs}/flatpak/{,**} r,
-  owner @{user_share_dirs}/flatpak/{,**} rw,
+  owner @{user_share_dirs}/ r,
+  owner @{user_share_dirs}/flatpak/{,**} rwl,
 
         /tmp/#@{int} rw,
   owner /dev/shm/flatpak*/{,**} rw,

apparmor.d/profiles-m-r/run-parts

@@ -104,7 +104,7 @@ profile run-parts @{exec_path} {
 
   # Motd
   /etc/update-motd.d/ r,
-  /etc/update-motd.d/@{int}-[a-z]* rCx -> motd,
+  /etc/update-motd.d/* rCx -> motd,
 
   # Kernel 
   /etc/kernel/header_postinst.d/ r,

apparmor.d/profiles-s-z/torsocks

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -9,9 +10,17 @@ include <tunables/global>
 @{exec_path} = @{bin}/torsocks
 profile torsocks @{exec_path} {
   include <abstractions/base>
+  # include <abstractions/app-launcher-root>
+
+  capability dac_read_search,
+
+  @{exec_path} rm,
 
-  @{exec_path} r,
   @{bin}/{,ba,da}sh  rix,
+  @{bin}/*          rPUx,
+  @{bin}/getcap      rix,
+
+  /etc/tor/torsocks.conf r,
 
   include if exists <local/torsocks>
 }