17 files changed, 25 insertions, 7 deletions

diff --git a/README.md b/README.md
index 906ff8481..e78c86709 100644
--- a/README.md
+++ b/README.md
@@ -207,13 +207,15 @@ AppArmor features are supported on overlayfs and chroot sandboxes.
 
 We are in the process of streamlining our AppArmor profile. The restrictions for /proc, /sys
 and /run/user directories were moved out of the profile into firejail executable.
-
-We intend to start apparmor by default for browsers, torrent clients and media players.
-So far we cover Firefox (firefox-common.profile), Chromium (chromium-common.profile),
-transmission-qt, transmission-gtk, vlc and mpv.
-
-"apparmor yes/no" flag in /etc/firejail/firejail.config file allows the user to enable/disable apparmor functionality globally
-By default the flag is enabled.
+We are also adding a "apparmor yes/no" flag in /etc/firejail/firejail.config file allows the user to
+enable/disable apparmor functionality globally. By default the flag is enabled.
+
+AppArmor deployment: we are starting apparmor by default for the following programs:
+- web browsers: firefox (firefox-common.profile), chromium (chromium-common.profile)
+- torrent clients: transmission-qt, transmission-gtk, qbittorrent
+- media players: vlc, mpv, audacious, totem, rhythmbox
+- media editing: kdenlive, audacity, handbrake, gimp, inkscape, krita, openshot
+- etc.: atril, gnome-calculator, galculator, eom, eog
 
 Checking apparmor status:
 `````
diff --git a/etc/atril.profile b/etc/atril.profile
index 215f0ab96..5d8cc54bd 100644
--- a/etc/atril.profile
+++ b/etc/atril.profile
@@ -31,6 +31,7 @@ protocol unix
 seccomp
 shell none
 tracelog
+apparmor
 
 private-bin atril, atril-previewer, atril-thumbnailer
 private-dev
diff --git a/etc/audacious.profile b/etc/audacious.profile
index 9a11022e3..818d4455b 100644
--- a/etc/audacious.profile
+++ b/etc/audacious.profile
@@ -26,6 +26,7 @@ protocol unix,inet,inet6
 seccomp
 shell none
 tracelog
+apparmor
 
 # private-bin audacious
 private-dev
diff --git a/etc/audacity.profile b/etc/audacity.profile
index ea1d38132..3575e297a 100644
--- a/etc/audacity.profile
+++ b/etc/audacity.profile
@@ -29,6 +29,7 @@ protocol unix
 seccomp
 shell none
 tracelog
+apparmor
 
 private-bin audacity
 private-dev
diff --git a/etc/eog.profile b/etc/eog.profile
index 6d61dceac..e5302a84f 100644
--- a/etc/eog.profile
+++ b/etc/eog.profile
@@ -32,6 +32,7 @@ novideo
 protocol unix
 seccomp
 shell none
+apparmor
 
 private-bin eog
 private-dev
diff --git a/etc/eom.profile b/etc/eom.profile
index c7af470c6..e5024a2bf 100644
--- a/etc/eom.profile
+++ b/etc/eom.profile
@@ -33,6 +33,7 @@ protocol unix
 seccomp
 shell none
 tracelog
+apparmor
 
 private-bin eom
 private-dev
diff --git a/etc/galculator.profile b/etc/galculator.profile
index 0923d7e55..c851e7038 100644
--- a/etc/galculator.profile
+++ b/etc/galculator.profile
@@ -32,6 +32,7 @@ protocol unix
 seccomp
 shell none
 tracelog
+apparmor
 
 private-bin galculator
 private-dev
diff --git a/etc/gimp.profile b/etc/gimp.profile
index 2a0698cc3..1f15677a1 100644
--- a/etc/gimp.profile
+++ b/etc/gimp.profile
@@ -26,6 +26,7 @@ notv
 protocol unix
 seccomp
 shell none
+apparmor
 
 private-dev
 private-tmp
diff --git a/etc/gnome-calculator.profile b/etc/gnome-calculator.profile
index 03e68a5cc..b6fcb0668 100644
--- a/etc/gnome-calculator.profile
+++ b/etc/gnome-calculator.profile
@@ -27,6 +27,7 @@ novideo
 protocol unix,inet,inet6
 seccomp
 shell none
+apparmor
 
 disable-mnt
 private-bin gnome-calculator
diff --git a/etc/handbrake.profile b/etc/handbrake.profile
index f8554d50c..dd814222b 100644
--- a/etc/handbrake.profile
+++ b/etc/handbrake.profile
@@ -23,6 +23,7 @@ novideo
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
+apparmor
 
 private-dev
 private-tmp
diff --git a/etc/inkscape.profile b/etc/inkscape.profile
index d2929412b..924691743 100644
--- a/etc/inkscape.profile
+++ b/etc/inkscape.profile
@@ -28,6 +28,7 @@ novideo
 protocol unix
 seccomp
 shell none
+apparmor
 
 # private-bin inkscape,potrace - problems on Debian stretch
 private-dev
diff --git a/etc/kdenlive.profile b/etc/kdenlive.profile
index b6d48356d..a52cd832f 100644
--- a/etc/kdenlive.profile
+++ b/etc/kdenlive.profile
@@ -25,6 +25,7 @@ notv
 protocol unix,netlink
 seccomp
 shell none
+apparmor
 
 private-bin kdenlive,kdenlive_render,dbus-launch,melt,ffmpeg,ffplay,ffprobe,dvdauthor,genisoimage,vlc,xine,kdeinit5,kshell5,kdeinit5_shutdown,kdeinit5_wrapper,kdeinit4,kshell4,kdeinit4_shutdown,kdeinit4_wrapper
 private-dev
diff --git a/etc/krita.profile b/etc/krita.profile
index c621e2c72..9fddf2214 100644
--- a/etc/krita.profile
+++ b/etc/krita.profile
@@ -27,6 +27,7 @@ novideo
 protocol unix
 seccomp
 shell none
+apparmor
 
 private-dev
 private-tmp
diff --git a/etc/openshot.profile b/etc/openshot.profile
index 1463303b0..5d81df193 100644
--- a/etc/openshot.profile
+++ b/etc/openshot.profile
@@ -25,6 +25,7 @@ notv
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
+apparmor
 
 private-dev
 private-tmp
diff --git a/etc/qbittorrent.profile b/etc/qbittorrent.profile
index da870ab76..60bcc73d2 100644
--- a/etc/qbittorrent.profile
+++ b/etc/qbittorrent.profile
@@ -39,6 +39,7 @@ novideo
 protocol unix,inet,inet6,netlink
 seccomp
 shell none
+apparmor
 
 private-bin qbittorrent,python*
 private-dev
diff --git a/etc/rhythmbox.profile b/etc/rhythmbox.profile
index 9401f6681..b6f16cecf 100644
--- a/etc/rhythmbox.profile
+++ b/etc/rhythmbox.profile
@@ -25,6 +25,7 @@ protocol unix,inet,inet6
 seccomp
 shell none
 tracelog
+apparmor
 
 private-bin rhythmbox
 private-dev
diff --git a/etc/totem.profile b/etc/totem.profile
index be0617024..2b591cc69 100644
--- a/etc/totem.profile
+++ b/etc/totem.profile
@@ -23,6 +23,7 @@ noroot
 protocol unix,inet,inet6
 seccomp
 shell none
+apparmor
 
 private-bin totem
 private-dev