feat(profiles): general update.

apparmor.d/groups/bus/dbus-daemon

@@ -48,6 +48,7 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
   /{usr/,}lib/@{multiarch}/tumbler-1/tumblerd    rPUx,
 
   /usr/share/org.gnome.Characters/org.gnome.Characters.BackgroundService rPx,
+  /usr/share/org.gnome.Characters/org.gnome.Characters rPx,
   /usr/share/gnome-documents/org.gnome.Documents rPx,
 
   /etc/dbus-1/{,**} r,

apparmor.d/groups/gnome/gnome-control-center-print-renderer

@@ -31,6 +31,7 @@ profile gnome-control-center-print-renderer @{exec_path} {
   /usr/share/egl/{,**} r,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /usr/share/icons/{,**} r,
+  /usr/share/libdrm/*.ids r,
   /usr/share/mime/mime.cache r,
   /usr/share/pixmaps/{,**} r,
   /usr/share/X11/xkb/** r,

apparmor.d/groups/gnome/gsd-media-keys

@@ -167,17 +167,17 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
   /usr/share/sounds/freedesktop/stereo/*.oga r,
   /usr/share/X11/xkb/** r,
 
+  /var/lib/gdm{3,}/.config/dconf/user r,
+  /var/lib/gdm{3,}/greeter-dconf-defaults r,
+  /var/lib/gdm{3,}/.config/pulse/client.conf r,
+  /var/lib/gdm{3,}/.config/pulse/cookie rk,
+
   owner @{user_config_dirs}/pulse/ rw,
 
   owner @{user_share_dirs}/ r,
   owner @{user_share_dirs}/event-sound-cache.tdb.* rwk,
   owner @{user_share_dirs}/recently-used.xbel{,.*} rw,
 
-  /var/lib/gdm{3,}/.config/dconf/user r,
-  /var/lib/gdm{3,}/greeter-dconf-defaults r,
-  /var/lib/gdm{3,}/.config/pulse/client.conf r,
-  /var/lib/gdm{3,}/.config/pulse/cookie rk,
-
         @{run}/systemd/inhibit/[0-9]*.ref rw,
   owner @{run}/user/@{uid}/gdm/Xauthority r,
   owner @{run}/user/@{uid}/wayland-[0-9]* rw,
@@ -186,6 +186,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
   owner /dev/tty[0-9]* rw,
 
   @{run}/udev/data/c13:[0-9]* r,      # for /dev/input/*
+
   @{sys}/devices/platform/**/uevent r,
   @{sys}/devices/**/usb[0-9]/{,**} r,
 

apparmor.d/groups/gnome/gsd-xsettings

@@ -128,6 +128,7 @@ profile gsd-xsettings @{exec_path} {
   @{libexec}/ibus-x11        rPx,
 
   /usr/share/dconf/profile/gdm r,
+  /usr/share/gdm/greeter-dconf-defaults r,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /usr/share/libdrm/*.ids r,
 

apparmor.d/groups/gnome/nautilus

@@ -85,6 +85,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
   @{sys}/devices/**/hwmon/{,name,temp*,fan*} r,
   @{sys}/devices/**/hwmon/**/{,name,temp*,fan*} r,
   @{sys}/devices/pci[0-9]*/**/revision r,
+  @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_cur_freq r,
 
         @{PROC}/@{pids}/net/wireless r,
         @{PROC}/sys/dev/i915/perf_stream_paranoid r,

apparmor.d/groups/pacman/archlinux-keyring-wkd-sync

@@ -24,6 +24,7 @@ profile archlinux-keyring-wkd-sync @{exec_path} {
   /{usr/,}bin/bash         rix,
   /{usr/,}bin/dirmngr      rix,
   /{usr/,}bin/gpg          rix,
+  /{usr/,}bin/gpg-agent    rix,
   /{usr/,}bin/pacman-conf  rix,
 
   /etc/pacman.conf r,

apparmor.d/groups/ubuntu/check-new-release-gtk

@@ -55,9 +55,9 @@ profile check-new-release-gtk @{exec_path} {
 
   owner @{run}/user/@{uid}/wayland-[0-9] rw,
 
-  owner @{PROC}/@{pid}/fd/ r,
         @{PROC}/@{pids}/mountinfo r,
         @{PROC}/@{pids}/mounts r,
+  owner @{PROC}/@{pid}/fd/ r,
 
   include if exists <local/check-new-release-gtk>
 }

apparmor.d/groups/virt/docker-proxy

@@ -0,0 +1,22 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = /{usr/,}bin/docker-proxy
+profile docker-proxy @{exec_path} {
+  include <abstractions/base>
+
+  capability net_admin,
+
+  @{exec_path} mr,
+
+  @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
+  
+  @{PROC}/sys/net/core/somaxconn r,
+
+  include if exists <local/docker-proxy>
+}

apparmor.d/groups/virt/dockerd

@@ -57,6 +57,7 @@ profile dockerd @{exec_path} flags=(attach_disconnected) {
   /{usr/,}{s,}bin/xtables-nft-multi   rix,
   /{usr/,}bin/containerd              rPx,
   /{usr/,}bin/docker-init             rix,
+  /{usr/,}bin/docker-proxy            rPx,
   /{usr/,}bin/kmod                    rPx,
   /{usr/,}bin/ps                      rPx,
   /{usr/,}bin/unpigz                  rix,

apparmor.d/profiles-a-f/aa-log

@@ -13,30 +13,22 @@ profile aa-log @{exec_path} {
 
   @{exec_path} mr,
 
-  /{usr/,}bin/journalctl rCx -> journalctl,
+  /{usr/,}bin/journalctl rix,
+
+  /etc/machine-id r,
+  /var/lib/dbus/machine-id r,
 
   /var/log/audit/* r,
 
+  /{run,var}/log/journal/ r,
+  /{run,var}/log/journal/@{hex}/ r,
+  /{run,var}/log/journal/@{hex}/user-@{uid}*.journal* r,
+  /{run,var}/log/journal/@{hex}/user-@{uid}.journal r,
+
   @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
 
-  profile journalctl {
+  @{PROC}/sys/kernel/random/boot_id r,
-    include <abstractions/base>
+  @{PROC}/sys/kernel/cap_last_cap r,
-    include <abstractions/consoles>
-
-    /{usr/,}bin/journalctl mr,
-
-    /var/lib/dbus/machine-id r,
-    /etc/machine-id r,
-
-    /{run,var}/log/journal/ r,
-    /{run,var}/log/journal/@{hex}/ r,
-    /{run,var}/log/journal/@{hex}/user-@{uid}*.journal* r,
-    /{run,var}/log/journal/@{hex}/user-@{uid}.journal r,
-
-    @{PROC}/sys/kernel/random/boot_id r,
-    @{PROC}/sys/kernel/cap_last_cap r,
-
-  }
 
   include if exists <local/aa-log>
 }

apparmor.d/profiles-g-l/keepassxc-proxy

@@ -22,6 +22,8 @@ profile keepassxc-proxy @{exec_path} {
 
   @{exec_path} mr,
 
+  /usr/share/icons/*/index.theme r,
+
   owner @{run}/user/@{pid}/org.keepassxc.KeePassXC.BrowserServer rw,
 
   # file_inherit
@@ -29,7 +31,6 @@ profile keepassxc-proxy @{exec_path} {
   deny owner @{run}/user/@{uid}/kpxc_server rw,
   deny       /dev/shm/org.chromium.* rw,
   deny owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* rw,
-  #
   deny owner @{HOME}/.mozilla/** rw,
   deny owner @{user_cache_dirs}/mozilla/** rw,
   deny owner @{MOUNTS}/.mozilla/** rw,
@@ -38,9 +39,7 @@ profile keepassxc-proxy @{exec_path} {
   deny owner /tmp/tmpaddon r,
   deny owner @{user_config_dirs}/google-chrome/** rw,
   deny owner @{user_config_dirs}/chromium/** rw,
-  #
+
-  /usr/share/icons/*/index.theme r,
-  #
   owner @{HOME}/.xsession-errors w,
   /dev/dri/renderD128 rw,
 

apparmor.d/profiles-s-z/udisksd

@@ -19,6 +19,8 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
   capability chown,
   capability dac_override,
   capability dac_read_search,
+  capability fowner,
+  capability fsetid,
   capability setgid,
   capability setuid,
   capability sys_admin,
@@ -44,9 +46,13 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
   mount fstype={btrfs,ext*,vfat,iso9660,udf,ntfs3} /dev/mmcblk[0-9]         -> @{MOUNTS}/*/,
   mount fstype={btrfs,ext*,vfat,iso9660,udf,ntfs3} /dev/mmcblk[0-9]*p[0-9]* -> @{MOUNTS}/*/,
 
+  # Allow mounting on temporary mount point
+  mount -> @{run}/udisks2/temp-mount-*/,
+
   # Allow unmounting
   umount @{MOUNTS}/,
   umount @{MOUNTS}/*/,
+  umount @{run}/udisks2/temp-mount-*/,
   umount /media/cdrom[0-9]/,
 
   dbus (send,receive) bus=system path=/org/freedesktop/UDisks2{,/**}
@@ -85,18 +91,20 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
   /{usr/,}bin/{,ba,da}sh      rix,
   /{usr/,}bin/umount          rix,
 
-  /{usr/,}{s,}bin/dmidecode   rPx,
+  /{usr/,}{s,}bin/dmidecode        rPx,
-  /{usr/,}{s,}bin/dumpe2fs    rPx,
+  /{usr/,}{s,}bin/dumpe2fs         rPx,
-  /{usr/,}{s,}bin/fsck.fat    rPx,
+  /{usr/,}{s,}bin/fsck.fat         rPx,
-  /{usr/,}{s,}bin/lvm         rPUx,
+  /{usr/,}{s,}bin/lvm              rPUx,
-  /{usr/,}{s,}bin/mke2fs      rPx,
+  /{usr/,}{s,}bin/mke2fs           rPx,
-  /{usr/,}{s,}bin/mkfs.btrfs  rPx,
+  /{usr/,}{s,}bin/mkfs.btrfs       rPx,
-  /{usr/,}{s,}bin/mkfs.fat    rPx,
+  /{usr/,}{s,}bin/mkfs.ext{2,3,4}  rPx,
-  /{usr/,}bin/eject           rPx,
+  /{usr/,}{s,}bin/mkfs.fat         rPx,
-  /{usr/,}bin/ntfs-3g         rPx,
+  /{usr/,}bin/eject                rPx,
-  /{usr/,}bin/ntfsfix         rPx,
+  /{usr/,}bin/ntfs-3g              rPx,
-  /{usr/,}bin/systemctl       rPx -> child-systemctl,
+  /{usr/,}{s,}bin/sfdisk           rPx,
-  /{usr/,}bin/systemd-escape  rPx,
+  /{usr/,}bin/ntfsfix              rPx,
+  /{usr/,}bin/systemctl            rPx -> child-systemctl,
+  /{usr/,}bin/systemd-escape       rPx,
 
   /etc/udisks2/{,**} r,
   /etc/libblockdev/{,**} r,

dists/flags/main.flags

@@ -46,6 +46,7 @@ cups-browsed complain
 cups-pk-helper-mechanism complain
 cupsd attach_disconnected,complain
 dkms attach_disconnected,complain
+docker-proxy complain
 dockerd attach_disconnected,complain
 downloadhelper complain
 e2fsck complain