Merge d5ca36fa2b into 026fbf7552

apparmor.d/groups/lxqt/lxqt-panel

@@ -0,0 +1,92 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
+# Copyright (C) 2024 Besanon  <m231009ts@mailfence.com>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{bin}/lxqt-panel
+profile lxqt-panel @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/audio-client>
+  include <abstractions/dconf-write>
+  include <abstractions/lxqt>
+  include <abstractions/nameservice-strict>
+
+  network inet dgram,
+  network inet6 dgram,
+  network inet stream,
+  network inet6 stream,
+  network netlink raw,
+  network packet dgram,
+
+  @{exec_path} mr,
+
+  @{bin}/exo-open rix,
+  @{lib}/gio-launch-desktop  rix,
+  @{bin}/nm-applet rPx,
+  @{bin}/nm-connection-editor rPx,
+  @{bin}/ControlPanel rPx,
+
+  @{bin}/sudo rCx -> root,
+
+  @{lib}/lxqt-panel/*.so mr, #  LXQT-Plugins
+  @{lib}/lxqt-config/*.so mr, # LXQT-Plugins
+
+  /usr/share/desktop-directories/{,**} r,
+  /usr/share/lxqt/{,**} r,
+
+  /etc/fstab r,
+  /etc/udev/udev.conf r,
+  /etc/machine-id r,
+  /etc/xdg/lxqt-qtxdg.conf r,
+  /etc/xdg/menus/**.menu r,
+  /etc/xdg/menus/applications-merged/ r,
+  /etc/xdg/ui/uistandards.rc r,
+
+  /var/lib/dbus/machine-id r,
+
+  owner @{HOME}/Desktop/*.desktop rw,
+  owner @{HOME}/Desktop/#@{int} rw,
+  owner @{HOME}/Desktop/*.desktop l -> @{HOME}/Desktop/#@{int},
+
+  owner @{user_config_dirs}/menus/*.menu rw,
+  owner @{user_config_dirs}/menus/applications-merged/ r,
+  owner @{user_config_dirs}/share/desktop-directories/*.directory r,
+  owner @{user_config_dirs}/share/gvfs-metadata/{,*} r,
+  owner @{user_config_dirs}/lxqt/#@{int} rw,
+  owner @{user_config_dirs}/lxqt/panel.conf rw,
+  owner @{user_config_dirs}/lxqt/panel.conf.lock rwk,
+  owner @{user_config_dirs}/lxqt/panel.conf.@{rand6} rw,
+  owner @{user_config_dirs}/lxqt/panel.conf.@{rand6} l -> @{user_config_dirs}/lxqt/#@{int},
+  owner @{user_config_dirs}/pulse/{,**} rwk,
+
+  @{run}/udev/data/* r,
+
+  @{sys}/class/i2c-adapter/ r,
+  @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_{cur,min,max}_freq r,
+
+  @{PROC}/@{pid}/fd/ r,
+  @{PROC}/@{pid}/net/dev r,
+  owner @{PROC}/@{pid}/mounts r,
+
+  /dev/tty rw,
+  /dev/tty@{int} rw,
+  /dev/pts/@{int} rw,
+  /dev/snd/controlC@{int} rw,
+
+  profile root {
+    include <abstractions/base>
+    include <abstractions/app/sudo>
+
+    @{bin}/lsblk rPx,
+
+    include if exists <local/lxqt-panel_root>
+  }
+
+  include if exists <local/lxqt-panel>
+}
+
+# vim:syntax=apparmor

apparmor.d/groups/pacman/mkinitcpio

@@ -83,10 +83,10 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) {
 
   # Manage /boot
   / r,
-  /{boot,efi}/ r,
+  /boot/ r,
   /{boot,efi}/EFI/{,**} rw,
-  /{boot,efi}/initramfs-*.img* rw,
-  /{boot,efi}/vmlinuz-* r,
+  /boot/initramfs-*.img* rw,
+  /boot/vmlinuz-* r,
 
   /usr/share/systemd/bootctl/** r,
 

apparmor.d/groups/pacman/pacman-hook-mkinitcpio

@@ -37,7 +37,7 @@ profile pacman-hook-mkinitcpio @{exec_path} flags=(attach_disconnected) {
 
   / r,
   /boot/ r,
-  /boot/efi/boot/boot*.efi rw,
+  /{boot,efi}/EFI/boot/boot*.efi rw,
   /boot/initramfs-*-fallback.img rw,
   /boot/initramfs-*.img rw,
   /boot/vmlinuz-* rw,

apparmor.d/profiles-s-z/tlp

@@ -66,20 +66,7 @@ profile tlp @{exec_path} flags=(attach_disconnected) {
   owner @{run}/tlp/* rw,
   owner @{run}/tlp/lock_tlp  rwk,
   
-  @{sys}/class/net/ r,
-  @{sys}/class/power_supply/ r,
-  @{sys}/bus/pci/drivers/mei_me/  r,
-  @{sys}/bus/pci/drivers/nouveau/  r,
-  @{sys}/bus/pci/drivers/xhci_hcd/  r,
-  @{sys}/devices/**/power_supply/BAT@{int}/type r,
-  @{sys}/devices/**/power_supply/BAT@{int}/present r,
-  @{sys}/devices/@{pci}/ r,
-  @{sys}/devices/@{pci}/power/control rw,
-  @{sys}/devices/platform/**/power_supply/ADP@{int}/online r,
-  @{sys}/devices/platform/**/power_supply/ADP@{int}/type r,
   @{sys}/devices/system/cpu/cpufreq/policy@{int}/energy_performance_preference rw,
-  @{sys}/devices/virtual/dmi/id/product_version r,
-  @{sys}/devices/virtual/net/lo/uevent r,
   @{sys}/module/pcie_aspm/parameters/policy rw,
   @{sys}/module/snd_hda_intel/parameters/power_save rw,
   @{sys}/module/snd_hda_intel/parameters/power_save_controller rw,
@@ -93,7 +80,6 @@ profile tlp @{exec_path} flags=(attach_disconnected) {
   owner @{PROC}/sys/kernel/nmi_watchdog rw,
 
   /dev/disk/by-id/ r,
-  owner /dev/sda r,
   /dev/tty rw,
 
   profile systemctl {