diff --git a/profiles/apparmor.d/QtWebEngineProcess b/profiles/apparmor.d/QtWebEngineProcess index 39cb07911..d04e90184 100644 --- a/profiles/apparmor.d/QtWebEngineProcess +++ b/profiles/apparmor.d/QtWebEngineProcess @@ -4,7 +4,7 @@ abi , include -profile QtWebEngineProcess /usr/lib/@{multiarch}/qt{5,6}/libexec/QtWebEngineProcess flags=(unconfined) { +profile QtWebEngineProcess /usr/lib{,64,exec}/{,@{multiarch}/}qt{,5,6}/{,libexec/}QtWebEngineProcess flags=(unconfined) { userns, @{exec_path} mr, diff --git a/profiles/apparmor.d/plasmashell b/profiles/apparmor.d/plasmashell index ea663d67e..c40d4f690 100644 --- a/profiles/apparmor.d/plasmashell +++ b/profiles/apparmor.d/plasmashell @@ -18,9 +18,7 @@ profile plasmashell /usr/bin/plasmashell { ptrace, # allow executing QtWebEngineProcess with full permissions including userns (using profile stacking to avoid no_new_privs issues) - /usr/lib/x86_64-linux-gnu/qt[56]/libexec/QtWebEngineProcess cx -> &plasmashell//QtWebEngineProcess, - /usr/libexec/qt[56]/QtWebEngineProcess cx -> &plasmashell//QtWebEngineProcess, - /usr/lib/qt6/libexec/QtWebEngineProcess cx -> &plasmashell//QtWebEngineProcess, + priority=1 /usr/lib{,64,exec}/{,@{multiarch}/}qt{,5,6}/{,libexec/}QtWebEngineProcess cx -> &plasmashell//QtWebEngineProcess, # allow to execute all other programs under their own profile, or to run unconfined /** pux,