feat(dbus): rewrite some dbus rules (4).

apparmor.d/groups/gnome/gsd-power

@@ -11,8 +11,9 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/audio>
   include <abstractions/bus/atspi>
+  include <abstractions/bus/login>
   include <abstractions/bus/upower>
-  include <abstractions/bus/vfs>
+  include <abstractions/bus/vfs/mount>
   include <abstractions/dbus-accessibility-strict>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
@@ -27,17 +28,43 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
 
   signal (receive) set=(term, hup) peer=gdm*,
 
-  dbus (send,receive) bus=system path=/org/freedesktop/UPower{,/**}
+  dbus bind bus=session name=org.gnome.SettingsDaemon.Power,
-       interface=org.freedesktop.{DBus.Properties,UPower*},
+  dbus (send, receive) bus=session path=/org/gnome/SettingsDaemon/Power
+       interface=org.freedesktop.DBus.Properties
+       peer=(name="{org.freedesktop.DBus,:*}", label="{gsd-media-keys,gnome-shell}"),
+
+  dbus send bus=session path=/org/gnome/SessionManager{,/**}
+       interface=org.freedesktop.DBus.Properties
+       peer=(name=:*),
+  dbus send bus=session path=/org/gnome/SessionManager{,/**}
+       interface=org.gnome.SessionManager
+       peer=(name=:*),
+  dbus receive bus=session path=/org/gnome/SessionManager{,/**}
+       interface=org.gnome.SessionManager{,.*}
+       peer=(name=:*, label=gnome-session-binary),
+  dbus receive bus=session path=/org/gnome/SessionManager{,/**}
+       interface=org.freedesktop.DBus.Properties
+       peer=(name=:*, label=gnome-session-binary),
+
+  dbus send bus=session path=/org/gnome/Mutter/**
+       interface=org.freedesktop.DBus.{Properties,ObjectManager}
+       peer=(name=:*, label=gnome-shell),
+  dbus send bus=session path=/org/gnome/Mutter/**
+       interface=org.gnome.Mutter.DisplayConfig
+       peer=(name=:*, label=gnome-shell),
+  dbus send bus=session path=/org/gnome/Mutter/**
+       interface=org.gnome.Mutter.IdleMonitor
+       peer=(name=:*, label=gnome-shell),
+
+  dbus send bus=system path=/org/freedesktop/UPower/KbdBacklight
+       interface=org.freedesktop.UPower.KbdBacklight
+       member=GetBrightness
+       peer=(name=:*, label=upowerd),
 
   dbus send bus=system path=/org/freedesktop/systemd[0-9]
        interface=org.freedesktop.DBus.Properties
        member=Get,
 
-  dbus send bus=system path=/org/freedesktop/login1
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll,
-
   dbus send bus=system path=/org/freedesktop/login1/session/auto
        interface=org.freedesktop.DBus.Properties
        member=GetAll,
@@ -46,96 +73,31 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
        interface=org.freedesktop.login1.Session
        member=SetBrightness,
 
-  dbus send bus=system path=/org/freedesktop/login1
-       interface=org.freedesktop.login1.Manager
-       member=Inhibit,
-
-  dbus receive bus=system path=/org/freedesktop/login1
-       interface=org.freedesktop.login1.Manager
-       member={SessionNew,SessionRemoved,PrepareForShutdown,UserNew,UserRemoved,PrepareForSleep}
-       peer=(name=:*, label=systemd-logind),
-
-  dbus receive bus=system path=/org/freedesktop/login1
-       interface=org.freedesktop.DBus.Properties
-       member=PropertiesChanged,
-
   dbus send bus=system path=/net/hadess/PowerProfiles
        interface=org.freedesktop.DBus.Properties
-       member=GetAll,
+       member=GetAll
+       peer=(name=:*, label=power-profiles-daemon),
 
   dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
        interface=org.freedesktop.DBus.Properties
        member={GetAll,PropertiesChanged}
        peer=(name=:*, label=gnome-session-binary),
 
-  dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member=EndSessionResponse
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member={CancelEndSession,QueryEndSession,EndSession,Stop}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member=RegisterClient
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member={ClientAdded,SessionRunning,ClientRemoved,InhibitorAdded,InhibitorRemoved}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/Mutter/DisplayConfig
-       interface=org.freedesktop.DBus.Properties
-       member={GetAll,GetResources,Set}
-       peer=(name=:*, label=gnome-shell),
-
-  dbus send bus=session path=/org/gnome/Mutter/DisplayConfig
-       interface=org.freedesktop.DBus.Properties
-       member=Set
-       peer=(name=:*, label=gsd-power),
-
-  dbus send bus=session path=/org/gnome/Mutter/DisplayConfig
-       interface=org.gnome.Mutter.DisplayConfig
-       member=GetResources
-       peer=(name=:*, label=gnome-shell),
-
-  dbus (send, receive) bus=session path=/org/gnome/SettingsDaemon/Power
-       interface=org.freedesktop.DBus.Properties
-       member={GetAll,PropertiesChanged,Set}
-       peer=(name="{org.freedesktop.DBus,:*}", label="{gsd-media-keys,gnome-shell}"),
-
-  dbus send bus=session path=/org/gnome/Mutter/IdleMonitor
-       interface=org.freedesktop.DBus.ObjectManager
-       member=GetManagedObjects
-       peer=(name=:*, label=gnome-shell),
-
-  dbus send bus=session path=/org/gnome/Mutter/IdleMonitor/Core
-       interface=org.gnome.Mutter.IdleMonitor
-       member={AddIdleWatch,AddUserActiveWatch,RemoveWatch}
-       peer=(name=:*, label=gnome-shell),
-
-  dbus receive bus=session path=/org/gnome/Mutter/IdleMonitor/Core
-       interface=org.gnome.Mutter.IdleMonitor
-       member=WatchFired
-       peer=(name=:*, label=gnome-shell),
 
   dbus receive bus=session path=/org/gnome/ScreenSaver
        interface=org.gnome.ScreenSaver
        member=ActiveChanged
        peer=(name=:*, label=gjs-console),
 
+  dbus send bus=system path=/org/freedesktop/systemd1
+       interface=org.freedesktop.DBus.Properties
+       peer=(name=org.freedesktop.systemd1, label="@{systemd}"),
+ 
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect
        peer=(name=:*, label=gnome-shell),
 
-  dbus bind bus=session
-       name=org.gnome.SettingsDaemon.Power,
-
   @{exec_path} mr,
 
   /usr/share/dconf/profile/gdm r,

apparmor.d/groups/systemd/systemd-localed

@@ -17,17 +17,11 @@ profile systemd-localed @{exec_path} flags=(attach_disconnected) {
   # Needed?
   audit capability net_admin,
 
-  dbus send bus=system path=/org/freedesktop/DBus
+  dbus bind bus=system name=org.freedesktop.locale1,
-       interface=org.freedesktop.DBus
-       member={ReleaseName,RequestName}
-       peer=(name=org.freedesktop.DBus),
-
   dbus receive bus=system path=/org/freedesktop/locale1
        interface=org.freedesktop.DBus.Properties
-       member=GetAll,
+       member=GetAll
-
+       peer=(name=:*, label=evolution-addressbook-factory),
-  dbus bind bus=system 
-       name=org.freedesktop.locale[0-9],
 
   @{exec_path} mr,
 

apparmor.d/groups/systemd/systemd-networkd

@@ -26,10 +26,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected,complain) {
   network packet dgram,
   network packet raw,
 
-  dbus send bus=system path=/org/freedesktop/DBus
+  dbus bind bus=system name=org.freedesktop.network1,
-       interface=org.freedesktop.DBus
-       member=RequestName
-       peer=(name=org.freedesktop.DBus),
 
   dbus send bus=system path=/org/freedesktop/hostname1
        interface=org.freedesktop.hostname1
@@ -45,9 +42,6 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected,complain) {
        member=PropertiesChanged 
        peer=(name=org.freedesktop.DBus),
 
-  dbus bind bus=system
-       name=org.freedesktop.network1,
-
   @{exec_path} mr,
 
   /var/lib/dbus/machine-id r,

apparmor.d/groups/systemd/systemd-user-runtime-dir

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{lib}/systemd/systemd-user-runtime-dir
 profile systemd-user-runtime-dir @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus/login>
   include <abstractions/dbus-strict>
   include <abstractions/nameservice-strict>
   include <abstractions/systemd-common>
@@ -22,11 +23,6 @@ profile systemd-user-runtime-dir @{exec_path} {
   mount fstype=tmpfs options=(rw,nosuid,nodev) -> @{run}/user/@{uid}/,
   umount @{run}/user/@{uid}/,
 
-  dbus send bus=system path=/org/freedesktop/login1
-       interface=org.freedesktop.DBus.Properties
-       member=Get
-       peer=(name=org.freedesktop.login1),
-
   @{exec_path} mr,
 
   /etc/machine-id r,

apparmor.d/profiles-a-f/fprintd

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{lib}/fprintd
 profile fprintd @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/bus/login>
   include <abstractions/dbus-strict>
   include <abstractions/devices-usb>
   include <abstractions/nameservice-strict>
@@ -23,11 +24,6 @@ profile fprintd @{exec_path} flags=(attach_disconnected) {
        interface={org.freedesktop.DBus.Properties,net.reactivated.Fprint.Manager}
        peer=(name=:*),
 
-  dbus send bus=system path=/org/freedesktop/login1
-       interface=org.freedesktop.login1.Manager
-       member=Inhibit
-       peer=(name=org.freedesktop.login1),
-
   @{exec_path} mr,
 
   /etc/fprintd.conf r,

apparmor.d/profiles-g-l/login

@@ -10,10 +10,11 @@ include <tunables/global>
 profile login @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/authentication>
+  include <abstractions/bus/login>
   include <abstractions/consoles>
+  include <abstractions/dbus-strict>
   include <abstractions/nameservice-strict>
   include <abstractions/wutmp>
-  include <abstractions/dbus-strict>
 
   capability audit_write,
   capability chown,
@@ -34,10 +35,6 @@ profile login @{exec_path} flags=(attach_disconnected) {
 
   ptrace read,
 
-  dbus send bus=system path=/org/freedesktop/login1
-       interface=org.freedesktop.login1.*
-       peer=(name=org.freedesktop.login1),
-
   @{exec_path} mr,
 
   @{bin}/{,z,ba,da}sh  rUx,

apparmor.d/profiles-m-r/needrestart-apt-pinvoke

@@ -9,14 +9,10 @@ include <tunables/global>
 @{exec_path} = @{lib}/needrestart/apt-pinvoke
 profile needrestart-apt-pinvoke @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus/login>
   include <abstractions/consoles>
   include <abstractions/dbus-strict>
 
-  dbus send bus=system path=/org/freedesktop/login1
-       interface=org.freedesktop.DBus.Properties
-       member=Get
-       peer=(name=org.freedesktop.login1, label=systemd-logind),
-
   @{exec_path} mr,
 
   @{bin}/{,ba,da}sh       rix,

apparmor.d/profiles-m-r/power-profiles-daemon

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{lib}/power-profiles-daemon
 profile power-profiles-daemon @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/bus/login>
   include <abstractions/bus/polkit>
   include <abstractions/dbus-strict>
   include <abstractions/nameservice-strict>
@@ -29,15 +30,6 @@ profile power-profiles-daemon @{exec_path} flags=(attach_disconnected) {
        interface=org.freedesktop.DBus.Properties
        peer=(name=org.freedesktop.DBus),
 
-  dbus send bus=system path=/org/freedesktop/login1
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll
-       peer=(name=:*, label=systemd-logind),
-
-  dbus receive bus=system path=/org/freedesktop/login1
-       interface=org.freedesktop.login1.Manager
-       peer=(name=:*, label=systemd-logind),
-
   @{exec_path} mr,
 
   /var/lib/power-profiles-daemon/{,**} rw,

apparmor.d/profiles-s-z/su

@@ -37,9 +37,10 @@ profile su @{exec_path} {
 
   network netlink raw,
 
-  dbus (send) bus=system path=/org/freedesktop/login1
+  dbus send bus=system path=/org/freedesktop/login1
-    interface=org.freedesktop.login1.Manager
+       interface=org.freedesktop.logi1.Manager
-    member={CreateSession,ReleaseSession},
+       member={CreateSession,ReleaseSession}
+       peer=(name=org.freedesktop.login1, label=systemd-logind),
 
   @{exec_path} mr,
 

apparmor.d/profiles-s-z/sudo

@@ -43,8 +43,8 @@ profile sudo @{exec_path} {
 
   dbus send bus=system path=/org/freedesktop/login1
        interface=org.freedesktop.logi1.Manager
-       member=CreateSession
+       member={CreateSession,ReleaseSession}
-       peer=(name=org.freedesktop.login1),
+       peer=(name=org.freedesktop.login1, label=systemd-logind),
 
   dbus (send receive) bus=session path=/org/freedesktop/systemd1
          interface=org.freedesktop.systemd.Manager

apparmor.d/profiles-s-z/switcheroo-control

@@ -15,16 +15,11 @@ profile switcheroo-control @{exec_path} flags=(attach_disconnected) {
 
   network netlink raw,
 
+  dbus bind bus=system name=net.hadess.SwitcherooControl,
   dbus receive bus=system path=/net/hadess/SwitcherooControl
        interface=org.freedesktop.DBus.Properties
-       member=GetAll,
+       member=GetAll
-
+       peer=(name=:*),
-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member=RequestName,
-
-  dbus bind bus=system 
-       name=net.hadess.SwitcherooControl,
 
   @{exec_path} mr,
 

apparmor.d/profiles-s-z/thunderbird

@@ -61,8 +61,8 @@ profile thunderbird @{exec_path} {
        member=Read
        peer=(name=:*),
 
-  dbus receive bus=system path=/org/freedesktop/login1*
+  dbus receive bus=system path=/org/freedesktop/login1
-       interface=org.freedesktop.login1*.Manager
+       interface=org.freedesktop.login1.Manager
        member={UserAdded,UserRemoved}
        peer=(name=:*, label=systemd-logind),
 

apparmor.d/profiles-s-z/udisksd

@@ -80,11 +80,6 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
        member={GetConnectionUnixUser,GetConnectionUnixProcessID}
        peer=(name=org.freedesktop.DBus, label=dbus-daemon),
 
-  dbus receive bus=system path=/org/freedesktop/login1*
-       interface=org.freedesktop.login1.Manager
-       member={PrepareForSleep,PrepareForShutdown}
-       peer=(name=:*, label=systemd-logind),
-
   @{exec_path} mr,
 
   @{bin}/{,ba,da}sh      rix,