feat(profiles): replace old [0-9]* glob by @{int}

Beware some [0-9]* glob are actually not proper @{int}.

apparmor.d/abstractions/chromium

@@ -181,7 +181,7 @@
   @{sys}/devices/pci[0-9]*/**/boot_vga r,
   @{sys}/devices/pci[0-9]*/**/{resource,irq} r,
   @{sys}/devices/pci[0-9]*/**/report_descriptor r,
-  @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r,
+  @{sys}/devices/system/cpu/cpufreq/policy@{int}/cpuinfo_max_freq r,
   @{sys}/devices/system/cpu/kernel_max r,
   @{sys}/devices/system/cpu/present r,
   @{sys}/devices/virtual/**/report_descriptor r,

apparmor.d/abstractions/dbus-session-strict.d/complete

@@ -8,6 +8,7 @@
   unix (connect, send, receive, accept) type=stream peer=(addr="@/tmp/dbus-????????"),
 
   owner @{run}/user/@{uid}/at-spi/ rw,
-  owner @{run}/user/@{uid}/at-spi/bus{,_[0-9]*} rw,
+  owner @{run}/user/@{uid}/at-spi/bus rw,
+  owner @{run}/user/@{uid}/at-spi/bus_@{int} rw,
 
   owner /tmp/dbus-@{rand8} rw,

apparmor.d/abstractions/kde-open5.d/complete

@@ -6,4 +6,4 @@
 
   owner @{user_config_dirs}/menus/{,**} r,
 
-  owner @{run}/user/@{uid}/kioclient*.[0-9]*.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int},
+  owner @{run}/user/@{uid}/kioclient*.@{int}.kioworker.socket rwl -> @{run}/user/@{uid}/#@{int},

apparmor.d/abstractions/nvidia.d/complete

@@ -8,4 +8,4 @@
 
   /etc/nvidia/nvidia-application-profiles* r,
 
-  /dev/char/195:[0-9]* rw,
+  /dev/char/195:@{int} rw,

apparmor.d/groups/akonadi/akonadi_birthdays_resource

@@ -22,7 +22,7 @@ profile akonadi_birthdays_resource @{exec_path} {
 
   /usr/share/hwdata/*.ids r,
   /usr/share/qt{5,}/translations/*.qm r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
 
   /etc/xdg/kdeglobals r,
   /etc/xdg/kwinrc r,

apparmor.d/groups/akonadi/akonadi_contacts_resource

@@ -22,7 +22,7 @@ profile akonadi_contacts_resource @{exec_path} {
   @{exec_path} mr,
 
   /usr/share/hwdata/*.ids r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
 
   /etc/xdg/kdeglobals r,
   /etc/xdg/kwinrc r,

apparmor.d/groups/akonadi/akonadi_control

@@ -26,7 +26,7 @@ profile akonadi_control @{exec_path} {
 
   /usr/share/akonadi/{,**} r,
   /usr/share/hwdata/*.ids r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
 
   /etc/xdg/kdeglobals r,
   /etc/xdg/kwinrc r,

apparmor.d/groups/akonadi/akonadi_followupreminder_agent

@@ -26,7 +26,7 @@ profile akonadi_followupreminder_agent @{exec_path} {
   @{exec_path} mr,
 
   /usr/share/hwdata/*.ids r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
 
   /etc/xdg/kdeglobals r,
   /etc/xdg/kwinrc r,

apparmor.d/groups/akonadi/akonadi_indexing_agent

@@ -24,7 +24,7 @@ profile akonadi_indexing_agent @{exec_path} {
   /usr/share/akonadi/plugins/serializer/ r,
   /usr/share/akonadi/plugins/serializer/*.desktop r,
   /usr/share/hwdata/*.ids r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
   /usr/share/mime/{,**} r,
 
   /etc/machine-id r,

apparmor.d/groups/akonadi/akonadi_maildir_resource

@@ -24,7 +24,7 @@ profile akonadi_maildir_resource @{exec_path} {
   /usr/share/akonadi/plugins/serializer/{,*.desktop} r,
   /usr/share/hwdata/*.ids r,
   /usr/share/mime/{,**} r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
 
   /etc/xdg/kdeglobals r,
   /etc/xdg/kwinrc r,

apparmor.d/groups/akonadi/akonadi_maildispatcher_agent

@@ -29,7 +29,7 @@ profile akonadi_maildispatcher_agent @{exec_path} {
 
   /usr/share/hwdata/*.ids r,
   /usr/share/mime/{,**} r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
 
   /etc/xdg/kdeglobals r,
   /etc/xdg/kwinrc r,

apparmor.d/groups/akonadi/akonadi_mailfilter_agent

@@ -27,7 +27,7 @@ profile akonadi_mailfilter_agent @{exec_path} {
   /usr/share/akonadi/plugins/serializer/*.desktop r,
 
   /usr/share/hwdata/*.ids r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
   /usr/share/mime/{,**} r,
 
   /etc/machine-id r,
@@ -62,7 +62,7 @@ profile akonadi_mailfilter_agent @{exec_path} {
   owner @{user_share_dirs}/akonadi/file_db_data/{,**} rw,
 
   @{sys}/devices/system/node/ r,
-  @{sys}/devices/system/node/node[0-9]*/meminfo r,
+  @{sys}/devices/system/node/node@{int}/meminfo r,
 
   @{PROC}/sys/kernel/core_pattern r,
   @{PROC}/sys/kernel/random/boot_id r,

apparmor.d/groups/akonadi/akonadi_mailmerge_agent

@@ -26,7 +26,7 @@ profile akonadi_mailmerge_agent @{exec_path} {
   @{exec_path} mr,
 
   /usr/share/hwdata/*.ids r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
   /usr/share/qt{5,}/translations/*.qm r,
   /usr/share/qt5/qtlogging.ini r,
 

apparmor.d/groups/akonadi/akonadi_migration_agent

@@ -22,7 +22,7 @@ profile akonadi_migration_agent @{exec_path} {
   @{exec_path} mr,
 
   /usr/share/hwdata/*.ids r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
 
   /etc/xdg/kdeglobals r,
   /etc/xdg/kwinrc r,

apparmor.d/groups/akonadi/akonadi_newmailnotifier_agent

@@ -24,7 +24,7 @@ profile akonadi_newmailnotifier_agent @{exec_path} {
   /usr/share/akonadi/plugins/serializer/{,*.desktop} r,
   /usr/share/hwdata/*.ids r,
   /usr/share/mime/{,**} r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
   /usr/share/knotifications5/akonadi_newmailnotifier_agent.notifyrc r,
 
   /etc/machine-id r,

apparmor.d/groups/akonadi/akonadi_notes_agent

@@ -27,7 +27,7 @@ profile akonadi_notes_agent @{exec_path} {
   @{exec_path} mr,
 
   /usr/share/hwdata/*.ids r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
   /usr/share/mime/{,**} r,
 
   /etc/xdg/kdeglobals r,

apparmor.d/groups/akonadi/akonadi_sendlater_agent

@@ -27,7 +27,7 @@ profile akonadi_sendlater_agent @{exec_path} {
   @{exec_path} mr,
 
   /usr/share/hwdata/*.ids r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
   /usr/share/mime/{,**} r,
 
   /etc/xdg/kdeglobals r,
@@ -45,7 +45,7 @@ profile akonadi_sendlater_agent @{exec_path} {
   owner @{user_config_dirs}/kwinrc r,
 
   @{sys}/devices/system/node/ r,
-  @{sys}/devices/system/node/node[0-9]*/meminfo r,
+  @{sys}/devices/system/node/node@{int}/meminfo r,
 
   @{PROC}/sys/kernel/core_pattern r,
 

apparmor.d/groups/akonadi/akonadi_unifiedmailbox_agent

@@ -23,7 +23,7 @@ profile akonadi_unifiedmailbox_agent @{exec_path} {
 
   /usr/share/hwdata/*.ids r,
   /usr/share/mime/{,**} r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
 
   /etc/xdg/kdeglobals r,
   /etc/xdg/kwinrc r,
@@ -40,7 +40,7 @@ profile akonadi_unifiedmailbox_agent @{exec_path} {
   owner @{user_config_dirs}/kwinrc r,
 
   @{sys}/devices/system/node/ r,
-  @{sys}/devices/system/node/node[0-9]*/meminfo r,
+  @{sys}/devices/system/node/node@{int}/meminfo r,
 
   @{PROC}/sys/kernel/core_pattern r,
   

apparmor.d/groups/apps/android-studio

@@ -248,7 +248,7 @@ profile android-studio @{exec_path} {
 
     # file_inherit
     owner @{HOME}/.android/avd/** r,
-    /dev/dri/card[0-9]* rw,
+    /dev/dri/card@{int} rw,
 
   }
 

apparmor.d/groups/apps/calibre

@@ -134,16 +134,16 @@ profile calibre @{exec_path} {
   owner @{user_cache_dirs}/qtshadercache/@{hex} rwl -> @{user_cache_dirs}/qtshadercache/#@{int},
   owner @{user_cache_dirs}/qtshadercache/#@{int} rw,
 
-  owner @{user_cache_dirs}/gstreamer-[0-9]*/ rw,
+  owner @{user_cache_dirs}/gstreamer-@{int}/ rw,
-  owner @{user_cache_dirs}/gstreamer-[0-9]*/registry.*.bin{,.tmp@{rand6}} rw,
+  owner @{user_cache_dirs}/gstreamer-@{int}/registry.*.bin{,.tmp@{rand6}} rw,
 
   owner @{user_config_dirs}/qt5ct/{,**} r,
 
   owner /tmp/calibre_*_tmp_*/{,**} rw,
   owner /tmp/calibre-*/{,**} rw,
-  owner /tmp/[0-9]*-*/ rw,
+  owner /tmp/@{int}-*/ rw,
-  owner /tmp/[0-9]*-*/** rwl,
+  owner /tmp/@{int}-*/** rwl,
-#  owner /tmp/[0-9]*-*/** rwl -> /tmp/[0-9]*-*/**,  # newer AA version
+#  owner /tmp/@{int}-*/** rwl -> /tmp/@{int}-*/**,  # newer AA version
   owner /tmp/* rw,
 
   owner /dev/shm/#@{int} rw,
@@ -167,7 +167,7 @@ profile calibre @{exec_path} {
   deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
   deny       @{PROC}/sys/kernel/random/boot_id r,
 
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/calibre>
 }

apparmor.d/groups/apps/discord

@@ -62,8 +62,8 @@ profile discord @{exec_path} {
 
   owner @{DISCORD_HOMEDIR}/ rw,
   owner @{DISCORD_HOMEDIR}/** rwk,
-  owner @{DISCORD_HOMEDIR}/[0-9]*/modules/discord_[a-z]*/*.node mrwk,
+  owner @{DISCORD_HOMEDIR}/@{int}/modules/discord_[a-z]*/*.node mrwk,
-  owner @{DISCORD_HOMEDIR}/[0-9]*/modules/discord_[a-z]*/lib*.so.[0-9] mrw,
+  owner @{DISCORD_HOMEDIR}/@{int}/modules/discord_[a-z]*/lib*.so.[0-9] mrw,
 
   # Reading of the /proc/ dir is needed to start discord.
   # Otherwise it returns the following error:
@@ -110,7 +110,7 @@ profile discord @{exec_path} {
   @{lib}/firefox/firefox rPx,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
 
   profile xdg-mime {

apparmor.d/groups/apps/filezilla

@@ -65,7 +65,7 @@ profile filezilla @{exec_path} {
   /*/*/ r,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/filezilla>
 }

apparmor.d/groups/apps/flameshot

@@ -66,7 +66,7 @@ profile flameshot @{exec_path} {
   /dev/shm/#@{int} rw,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
 
   profile open {

apparmor.d/groups/apps/freetube

@@ -93,7 +93,7 @@ profile freetube @{exec_path} {
   @{bin}/vlc             rPx,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
 
   profile open {

apparmor.d/groups/apps/spotify

@@ -70,7 +70,7 @@ profile spotify @{exec_path} {
   owner /tmp/@{hex}-@{hex}-@{hex}-@{hex} rw,
 
   # What's this for?
-  #owner /tmp/[0-9]*.[0-9]*.[0-9]*.[0-9]*-linux-*.zip rw,
+  #owner /tmp/@{int}.@{int}.@{int}.[0-9]*-linux-*.zip rw,
 
   include if exists <local/spotify>
 }

apparmor.d/groups/apps/telegram-desktop

@@ -88,7 +88,7 @@ profile telegram-desktop @{exec_path} {
   @{bin}/geany           rPx,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
 
   profile open {

apparmor.d/groups/apps/vlc

@@ -194,7 +194,7 @@ profile vlc @{exec_path} {
   audit owner @{PROC}/@{pid}/cmdline r,
 
         /dev/shm/#@{int} rw,
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   # Silencer
   deny @{lib}/@{multiarch}/vlc/{,**} w,
@@ -217,7 +217,7 @@ profile vlc @{exec_path} {
     owner @{HOME}/.Xauthority r,
 
     # file_inherit
-    /dev/dri/card[0-9]* rw,
+    /dev/dri/card@{int} rw,
     network inet stream,
     network inet6 stream,
 

apparmor.d/groups/apt/apt

@@ -144,7 +144,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
         /tmp/apt-changelog-*/*.changelog w,
   owner /tmp/apt-changelog-*/.apt-acquire-privs-test.* rw,
   owner /tmp/apt-dpkg-install-*/ rw,
-  owner /tmp/apt-dpkg-install-*/[0-9]*-*.deb w,
+  owner /tmp/apt-dpkg-install-*/@{int}-*.deb w,
   owner /tmp/apt.conf.* rw,
   owner /tmp/apt.data.* rw,
 

apparmor.d/groups/apt/apt-listbugs

@@ -23,7 +23,7 @@ profile apt-listbugs @{exec_path} {
   network netlink raw,
 
   @{exec_path} r,
-  @{bin}/ruby[0-9].[0-9]* rix,
+  @{bin}/ruby[0-9].@{int} rix,
 
   @{bin}/{,ba,da}sh       rix,
   @{bin}/logname          rix,

apparmor.d/groups/apt/apt-listbugs-migratepins

@@ -13,7 +13,7 @@ profile apt-listbugs-migratepins @{exec_path} {
   include <abstractions/ruby>
 
   @{exec_path} r,
-  @{bin}/ruby[0-9].[0-9]* rix,
+  @{bin}/ruby[0-9].@{int} rix,
 
   /usr/share/rubygems-integration/*/specifications/ r,
   /usr/share/rubygems-integration/*/specifications/*.gemspec rwk,

apparmor.d/groups/apt/apt-listbugs-prefclean

@@ -13,7 +13,7 @@ profile apt-listbugs-prefclean @{exec_path} {
   include <abstractions/ruby>
 
   @{exec_path} r,
-  @{bin}/ruby[0-9].[0-9]* rix,
+  @{bin}/ruby[0-9].@{int} rix,
 
   @{bin}/date rix,
   @{bin}/cat rix,

apparmor.d/groups/apt/apt-mark

@@ -25,7 +25,7 @@ profile apt-mark @{exec_path} {
   /var/cache/apt/ r,
   /var/cache/apt/** rwk,
 
-  /dev/pts/[0-9]* rw,
+  /dev/pts/@{int} rw,
 
   include if exists <local/apt-mark>
 }

apparmor.d/groups/apt/apt-methods-cdrom

@@ -38,7 +38,7 @@ profile apt-methods-cdrom @{exec_path} {
   @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/apt-methods-cdrom>
 }

apparmor.d/groups/apt/apt-methods-copy

@@ -48,7 +48,7 @@ profile apt-methods-copy @{exec_path} {
   @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
   /var/log/cron-apt/temp w,
 
   include if exists <local/apt-methods-copy>

apparmor.d/groups/apt/apt-methods-file

@@ -48,7 +48,7 @@ profile apt-methods-file @{exec_path} {
   @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
   /var/log/cron-apt/temp w,
 
   include if exists <local/apt-methods-file>

apparmor.d/groups/apt/apt-methods-ftp

@@ -38,7 +38,7 @@ profile apt-methods-ftp @{exec_path} {
   @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/apt-methods-ftp>
 }

apparmor.d/groups/apt/apt-methods-gpgv

@@ -89,7 +89,7 @@ profile apt-methods-gpgv @{exec_path} {
   @{PROC}/@{pid}/fd/ r,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
   /var/log/cron-apt/temp w,
 
   include if exists <local/apt-methods-gpgv>

apparmor.d/groups/apt/apt-methods-http

@@ -75,7 +75,7 @@ profile apt-methods-http @{exec_path} {
   @{PROC}/1/cgroup r,
   @{PROC}/@{pid}/cgroup r,
 
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/apt-methods-http>
 }

apparmor.d/groups/apt/apt-methods-mirror

@@ -38,7 +38,7 @@ profile apt-methods-mirror @{exec_path} {
   @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/apt-methods-mirror>
 }

apparmor.d/groups/apt/apt-methods-rred

@@ -48,7 +48,7 @@ profile apt-methods-rred @{exec_path} {
   @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
   /var/log/cron-apt/temp w,
 
   include if exists <local/apt-methods-rred>

apparmor.d/groups/apt/apt-methods-rsh

@@ -38,7 +38,7 @@ profile apt-methods-rsh @{exec_path} {
   @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/apt-methods-rsh>
 }

apparmor.d/groups/apt/apt-methods-store

@@ -54,7 +54,7 @@ profile apt-methods-store @{exec_path} {
   @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
   owner /var/log/cron-apt/temp w,
 
   include if exists <local/apt-methods-store>

apparmor.d/groups/apt/apt-show-versions

@@ -37,7 +37,7 @@ profile apt-show-versions @{exec_path} {
   @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
   owner /var/log/cron-apt/temp w,
 
   include if exists <local/apt-show-versions>

apparmor.d/groups/apt/aptitude

@@ -124,7 +124,7 @@ profile aptitude @{exec_path} flags=(complain) {
   owner /tmp/aptitude-*.@{pid}:*/{pkgstates,control}* rw,
         /tmp/aptitude-*.@{pid}:*/pkgstates* r,
   owner /tmp/apt-dpkg-install-*/ rw,
-  owner /tmp/apt-dpkg-install-*/[0-9]*-*.deb w,
+  owner /tmp/apt-dpkg-install-*/@{int}-*.deb w,
 
   /var/cache/apt/ r,
   /var/cache/apt/** rwk,
@@ -152,7 +152,7 @@ profile aptitude @{exec_path} flags=(complain) {
   #  aptitude[]: /dev/tty2: Permission denied
   #  aptitude[]: *** err
   #  aptitude[]: Oh, oh, it's an error! possibly I die!
-  /dev/tty[0-9]* rw,
+  /dev/tty@{int} rw,
 
   /dev/ptmx rw,
 

apparmor.d/groups/apt/command-not-found

@@ -29,7 +29,7 @@ profile command-not-found @{exec_path} {
 
   owner @{PROC}/@{pid}/fd/ r,
 
-  /dev/tty[0-9]* rw,
+  /dev/tty@{int} rw,
 
   # Silencer
   deny /usr/lib/ r,

apparmor.d/groups/apt/deborphan

@@ -17,7 +17,7 @@ profile deborphan @{exec_path} {
   /var/lib/dpkg/status r,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
   owner @{HOME}/.synaptic/selections.{update,proceed} w,
 
   include if exists <local/deborphan>

apparmor.d/groups/apt/dpkg

@@ -110,7 +110,7 @@ profile dpkg @{exec_path} {
   owner @{PROC}/@{pid}/fd/ r,
         @{PROC}/sys/kernel/random/boot_id r,
 
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   profile diff {
     include <abstractions/base>

apparmor.d/groups/apt/dpkg-query

@@ -23,7 +23,7 @@ profile dpkg-query @{exec_path} {
 
   # file_inherit
   /tmp/#@{int} rw,
-  /dev/tty[0-9]* rw,
+  /dev/tty@{int} rw,
 
   include if exists <local/dpkg-query>
 }

apparmor.d/groups/apt/synaptic

@@ -129,7 +129,7 @@ profile synaptic @{exec_path} {
 
         /tmp/ r,
   owner /tmp/apt-dpkg-install-*/ rw,
-  owner /tmp/apt-dpkg-install-*/[0-9]*-*.deb w,
+  owner /tmp/apt-dpkg-install-*/@{int}-*.deb w,
 
   /var/cache/apt/ r,
   /var/cache/apt/** rwk,
@@ -156,7 +156,7 @@ profile synaptic @{exec_path} {
   @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
 
   profile dbus {

apparmor.d/groups/apt/update-apt-xapian-index

@@ -37,7 +37,7 @@ profile update-apt-xapian-index @{exec_path} {
   /etc/machine-id r,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/update-apt-xapian-index>
 }

apparmor.d/groups/browsers/chrome-crashpad-handler

@@ -29,8 +29,8 @@ profile chrome-crashpad-handler @{exec_path} {
   owner @{PROC}/@{pids}/stat r,
   owner @{PROC}/@{pids}/task/ r,
 
-  @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_cur_freq r,
+  @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_cur_freq r,
-  @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_max_freq r,
+  @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_max_freq r,
 
   include if exists <local/chrome-crashpad-handler>
 }

apparmor.d/groups/browsers/chromium-crashpad-handler

@@ -28,8 +28,8 @@ profile chromium-crashpad-handler @{exec_path} {
   owner @{PROC}/@{pids}/stat r,
   owner @{PROC}/@{pids}/task/ r,
 
-  @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_cur_freq r,
+  @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_cur_freq r,
-  @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_max_freq r,
+  @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_max_freq r,
 
   include if exists <local/chromium-crashpad-handler>
 }

apparmor.d/groups/browsers/chromium-wrapper

@@ -42,7 +42,7 @@ profile chromium-wrapper @{exec_path} {
   owner /tmp/tmp.*/ rw,
   owner /tmp/tmp.*/** rwk,
 
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
         /dev/dri/card[0-9] rw,
 
   # Silencer

apparmor.d/groups/browsers/firefox

@@ -185,8 +185,8 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
   owner @{HOME}/ r,
 
   owner @{user_cache_dirs}/ rw,
-  owner @{user_cache_dirs}/gstreamer-[0-9]*/ rw,
+  owner @{user_cache_dirs}/gstreamer-@{int}/ rw,
-  owner @{user_cache_dirs}/gstreamer-[0-9]*/registry.*.bin{,.tmp*} rw,
+  owner @{user_cache_dirs}/gstreamer-@{int}/registry.*.bin{,.tmp*} rw,
 
   owner @{user_config_dirs}/ r,
   owner @{user_config_dirs}/gtk-{3,4}.0/assets/*.svg r,
@@ -237,7 +237,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
   @{sys}/class/**/ r,
   @{sys}/devices/**/uevent r,
   @{sys}/devices/pci[0-9]*/**/ r,
-  @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/ r,
+  @{sys}/devices/pci[0-9]*/**/drm/card@{int}/ r,
   @{sys}/devices/pci[0-9]*/**/drm/renderD[0-9]*/ r,
   @{sys}/devices/pci[0-9]*/**/irq r,
   @{sys}/devices/system/cpu/cpu[0-9]/cache/index[0-9]/size r,
@@ -269,15 +269,15 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
   owner @{PROC}/@{pids}/environ r,
 
         /dev/ r,
-        /dev/hidraw[0-9]* rw,
+        /dev/hidraw@{int} rw,
         /dev/shm/ r,
         /dev/tty rw,
-        /dev/video[0-9]* rw,
+        /dev/video@{int} rw,
-  owner /dev/dri/card[0-9]* rw, # File Inherit
+  owner /dev/dri/card@{int} rw, # File Inherit
   owner /dev/shm/org.chromium.* rw,
-  owner /dev/shm/org.mozilla.ipc.@{pid}.[0-9]* rw,
+  owner /dev/shm/org.mozilla.ipc.@{pid}.@{int} rw,
-  owner /dev/shm/wayland.mozilla.ipc.[0-9]* rw,
+  owner /dev/shm/wayland.mozilla.ipc.@{int} rw,
-  owner /dev/tty[0-9]* rw, # File Inherit
+  owner /dev/tty@{int} rw, # File Inherit
 
   # X-tiny
   /tmp/.X0-lock r,

apparmor.d/groups/browsers/firefox-crashreporter

@@ -54,9 +54,9 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) {
   owner /tmp/@{hex}.{dmp,extra} rw,
   owner /tmp/firefox/.parentlock w,
 
-  owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* r,
+  owner /dev/shm/org.mozilla.ipc.@{int}.@{int} r,
 
-  /dev/dri/card[0-9]* rw,
+  /dev/dri/card@{int} rw,
   /dev/dri/renderD128 rw,
 
   # Silencer

apparmor.d/groups/browsers/firefox-kmozillahelper

@@ -22,7 +22,7 @@ profile firefox-kmozillahelper @{exec_path} {
   @{exec_path} mr,
 
   /usr/share/hwdata/*.ids r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
   /usr/share/kservices5/{,**} r,
   /usr/share/mime/ r,
 

apparmor.d/groups/browsers/firefox-minidump-analyzer

@@ -37,7 +37,7 @@ profile firefox-minidump-analyzer @{exec_path} {
   owner /tmp/@{hex}.{dmp,extra} rw,
   owner /tmp/firefox/.parentlock w,
 
-  owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* r,
+  owner /dev/shm/org.mozilla.ipc.@{int}.@{int} r,
 
   owner @{PROC}/@{pid}/task/@{tid}/stat r,
   owner @{PROC}/@{pid}/stat r,

apparmor.d/groups/browsers/firefox-pingsender

@@ -27,7 +27,7 @@ profile firefox-pingsender @{exec_path} {
   owner @{PROC}/@{pid}/stat r,
   owner @{PROC}/@{pid}/task/@{tid}/stat r,
 
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/firefox-pingsender>
 }

apparmor.d/groups/bus/dbus-daemon

@@ -96,9 +96,9 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
         @{PROC}/cmdline r,
         @{PROC}/sys/kernel/osrelease r,
 
-  /dev/dri/card[0-9]* rw,
+  /dev/dri/card@{int} rw,
-  /dev/input/event[0-9]* rw,
+  /dev/input/event@{int} rw,
-  /dev/tty[0-9]* rw,
+  /dev/tty@{int} rw,
 
   include if exists <local/dbus-daemon>
 }

apparmor.d/groups/bus/dbus-run-session

@@ -34,7 +34,7 @@ profile dbus-run-session @{exec_path} {
 
   # file_inherit
   /dev/tty rw,
-  /dev/tty[0-9]* rw,
+  /dev/tty@{int} rw,
 
   include if exists <local/dbus-run-session>
 }

apparmor.d/groups/bus/ibus-daemon

@@ -62,7 +62,7 @@ profile ibus-daemon @{exec_path} flags=(attach_disconnected) {
 
   owner @{PROC}/@{pids}/fd/ r,
 
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/ibus-daemon>
 }

apparmor.d/groups/bus/ibus-dconf

@@ -43,7 +43,7 @@ profile ibus-dconf @{exec_path} flags=(attach_disconnected) {
   owner @{user_config_dirs}/ibus/bus/ r,
   owner @{user_config_dirs}/ibus/bus/@{md5}-unix-{,wayland-}@{int} r,
 
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/ibus-dconf>
 }

apparmor.d/groups/bus/ibus-engine-simple

@@ -23,7 +23,7 @@ profile ibus-engine-simple @{exec_path} flags=(attach_disconnected) {
   /var/lib/gdm{3,}/.config/ibus/bus/ r,
   /var/lib/gdm{3,}/.config/ibus/bus/@{md5}-unix-{,wayland-}@{int} r,
 
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/ibus-engine-simple>
 }

apparmor.d/groups/bus/ibus-extension-gtk3

@@ -80,7 +80,7 @@ profile ibus-extension-gtk3 @{exec_path} flags=(attach_disconnected) {
   /var/lib/gdm{3,}/greeter-dconf-defaults r,
 
   # file inherit
-  /dev/tty[0-9]* rw,
+  /dev/tty@{int} rw,
 
   include if exists <local/ibus-extension-gtk3>
 }

apparmor.d/groups/bus/ibus-portal

@@ -39,7 +39,7 @@ profile ibus-portal @{exec_path} flags=(attach_disconnected) {
   /var/lib/gdm{3,}/.config/ibus/bus/ r,
   /var/lib/gdm{3,}/.config/ibus/bus/@{md5}-unix-{,wayland-}@{int} r,
 
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/ibus-portal>
 }

apparmor.d/groups/bus/ibus-x11

@@ -53,7 +53,7 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) {
   owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r,
   owner @{run}/user/@{uid}/gdm/Xauthority r,
 
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/ibus-x11>
 }

apparmor.d/groups/children/child-pager

@@ -32,7 +32,7 @@ profile child-pager {
 
   owner @{HOME}/ r,
   owner @{HOME}/.lesshs* rw,
-  owner @{HOME}/.terminfo/[0-9]*/* r,
+  owner @{HOME}/.terminfo/@{int}/* r,
   owner @{user_cache_dirs}/lesshs* rw,
   owner @{user_state_dirs}/ r,
   owner @{user_state_dirs}/lesshs* rw,

apparmor.d/groups/freedesktop/at-spi-bus-launcher

@@ -54,7 +54,7 @@ profile at-spi-bus-launcher @{exec_path} flags=(attach_disconnected) {
   owner @{PROC}/@{pid}/fd/ r,
         @{PROC}/1/cgroup r,
 
-  owner /dev/tty[0-9]* rw,  # file_inherit
+  owner /dev/tty@{int} rw,  # file_inherit
 
   include if exists <local/at-spi-bus-launcher>
 }

apparmor.d/groups/freedesktop/at-spi2-registryd

@@ -95,7 +95,7 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
   owner @{run}/user/@{uid}/gdm/Xauthority r,
   owner @{run}/user/@{uid}/xauth_@{rand6} r,
 
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/at-spi2-registryd>
 }

apparmor.d/groups/freedesktop/cpupower

@@ -10,7 +10,7 @@ include <tunables/global>
 profile cpupower @{exec_path} {
   include <abstractions/base>
 
-  # Needed to read the /dev/cpu/[0-9]*/msr device, and hence remove the following error:
+  # Needed to read the /dev/cpu/@{int}/msr device, and hence remove the following error:
   #  Could not read perf-bias value[-1]
   capability sys_rawio,
 
@@ -25,19 +25,19 @@ profile cpupower @{exec_path} {
 
   @{sys}/devices/system/cpu/{cpufreq,cpuidle}/ r,
   @{sys}/devices/system/cpu/{cpufreq,cpuidle}/** r,
-  @{sys}/devices/system/cpu/cpu[0-9]*/{cpufreq,cpuidle}/ r,
+  @{sys}/devices/system/cpu/cpu@{int}/{cpufreq,cpuidle}/ r,
-  @{sys}/devices/system/cpu/cpu[0-9]*/{cpufreq,cpuidle}/** r,
+  @{sys}/devices/system/cpu/cpu@{int}/{cpufreq,cpuidle}/** r,
 
-  @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_{min,max}_freq rw,
+  @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_{min,max}_freq rw,
-  @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_governor rw,
+  @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_governor rw,
-  @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/scaling_setspeed rw,
+  @{sys}/devices/system/cpu/cpufreq/policy@{int}/scaling_setspeed rw,
-  @{sys}/devices/system/cpu/cpu[0-9]*/cpuidle/state[0-9]/disable rw,
+  @{sys}/devices/system/cpu/cpu@{int}/cpuidle/state[0-9]/disable rw,
 
-  @{sys}/devices/system/cpu/cpu[0-9]*/topology/{physical_package_id,core_id} r,
+  @{sys}/devices/system/cpu/cpu@{int}/topology/{physical_package_id,core_id} r,
 
-  @{sys}/devices/system/cpu/cpu[0-9]*/online r,
+  @{sys}/devices/system/cpu/cpu@{int}/online r,
 
-  /dev/cpu/[0-9]*/msr r,
+  /dev/cpu/@{int}/msr r,
 
 
   profile kmod {

apparmor.d/groups/freedesktop/dconf-editor

@@ -27,7 +27,7 @@ profile dconf-editor @{exec_path} {
   owner @{user_config_dirs}/glib-2.0/settings/.goutputstream-@{rand6} rw,
 
   owner @{HOME}/.Xauthority r,
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/dconf-editor>
 }

apparmor.d/groups/freedesktop/dconf-service

@@ -52,7 +52,7 @@ profile dconf-service @{exec_path} flags=(attach_disconnected) {
 
   @{PROC}/cmdline r,
 
-  /dev/tty[0-9]* rw,
+  /dev/tty@{int} rw,
 
   include if exists <local/dconf-service>
 }

apparmor.d/groups/freedesktop/fc-cache

@@ -7,7 +7,7 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-@{exec_path} = /{snap/snapd/[0-9]*/,}{usr/,}bin/fc-cache{,-32,-v*}
+@{exec_path} = /{snap/snapd/@{int}/,}{usr/,}bin/fc-cache{,-32,-v*}
 profile fc-cache @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>

apparmor.d/groups/freedesktop/pipewire

@@ -82,7 +82,7 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
 
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,
 
-  /dev/media[0-9]* rw,
+  /dev/media@{int} rw,
 
   include if exists <local/pipewire>
 }

apparmor.d/groups/freedesktop/pipewire-media-session

@@ -70,11 +70,11 @@ profile pipewire-media-session @{exec_path} {
   @{sys}/devices/pci[0-9]*/**/sound/**/pcm_class r,
   @{sys}/devices/pci[0-9]*/**/video4linux/video[0-9]*/uevent r,
   @{sys}/devices/system/node/ r,
-  @{sys}/devices/system/node/node[0-9]*/meminfo r,
+  @{sys}/devices/system/node/node@{int}/meminfo r,
 
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,
 
-  /dev/video[0-9]* rw,
+  /dev/video@{int} rw,
   /dev/snd/ r,
 
   include if exists <local/pipewire-media-session>

apparmor.d/groups/freedesktop/plymouthd

@@ -59,7 +59,7 @@ profile plymouthd @{exec_path} {
   owner @{PROC}/@{pid}/stat r,
 
   /dev/ptmx rw,
-  /dev/tty[0-9]* rw,
+  /dev/tty@{int} rw,
   /dev/ttyS[0-9]* rw,
 
   include if exists <local/plymouthd>

apparmor.d/groups/freedesktop/polkit-agent-helper

@@ -49,7 +49,7 @@ profile polkit-agent-helper @{exec_path} {
   owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/loginuid r,
 
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/polkit-agent-helper>
 }

apparmor.d/groups/freedesktop/polkit-kde-authentication-agent

@@ -32,7 +32,7 @@ profile polkit-kde-authentication-agent @{exec_path} {
   @{lib}/polkit-[0-9]/polkit-agent-helper-[0-9] rPx,
 
   /usr/share/hwdata/pnp.ids r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
   /usr/share/qt5ct/** r,
 
   /etc/machine-id r,

apparmor.d/groups/freedesktop/polkit-mate-authentication-agent

@@ -33,7 +33,7 @@ profile polkit-mate-authentication-agent @{exec_path} {
 
   owner @{HOME}/.Xauthority r,
 
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
         @{PROC}/1/cgroup r,
   owner @{PROC}/@{pid}/cgroup r,

apparmor.d/groups/freedesktop/pulseaudio

@@ -190,11 +190,11 @@ profile pulseaudio @{exec_path} {
   owner @{PROC}/@{pids}/stat r,
   owner @{PROC}/@{pids}/cmdline r,
 
-  /dev/media[0-9]* r,
+  /dev/media@{int} r,
-  /dev/video[0-9]* rw,
+  /dev/video@{int} rw,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
   owner @{HOME}/.xsession-errors w,
 
   include if exists <local/pulseaudio>

apparmor.d/groups/freedesktop/update-mime-database

@@ -19,8 +19,8 @@ profile update-mime-database @{exec_path} {
 
   /usr/share/mime/{,**} rw,
 
-  /dev/tty[0-9]* rw,
+  /dev/tty@{int} rw,
-  owner /dev/pts/[0-9]* rw,
+  owner /dev/pts/@{int} rw,
 
   # Inherit silencer
   deny network inet6 stream,

apparmor.d/groups/freedesktop/xdg-dbus-proxy

@@ -44,7 +44,7 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
        member=GetSettings
        peer=(label=NetworkManager),
 
-  owner @{run}/firejail/dbus/[0-9]*/[0-9]*-{system,user} rw,
+  owner @{run}/firejail/dbus/@{int}/@{int}-{system,user} rw,
   owner @{run}/user/@{uid}/.dbus-proxy/{system,session,a11y}-bus-proxy-[0-9A-Z]* rw,
   owner @{run}/user/@{uid}/webkitgtk/a11y-proxy-[0-9A-Z]* rw,
   owner @{run}/user/@{uid}/webkitgtk/bus-proxy-[0-9A-Z]* rw,
@@ -52,7 +52,7 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
 
   @{sys}/devices/virtual/thermal/thermal_zone[0-9]/hwmon[0-9]/temp* r,
 
-  /dev/dri/card[0-9]* rw,
+  /dev/dri/card@{int} rw,
 
   deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
 

apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome

@@ -129,7 +129,7 @@ profile xdg-desktop-portal-gnome @{exec_path} {
 
   /usr/share/X11/xkb/{,**} r,
 
-  /var/cache/gio-[0-9]*.[0-9]*/gnome-mimeapps.list r,
+  /var/cache/gio-@{int}.@{int}/gnome-mimeapps.list r,
   /var/lib/snapd/desktop/icons/{,**} r,
 
   owner @{HOME}/*/{,**} rw,

apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk

@@ -157,7 +157,7 @@ profile xdg-desktop-portal-gtk @{exec_path} {
 
   / r,
 
-  owner /var/lib/xkb/server-[0-9]*.xkm rw,
+  owner /var/lib/xkb/server-@{int}.xkm rw,
 
   owner @{HOME}/ r,
   owner @{HOME}/.* r,

apparmor.d/groups/freedesktop/xdg-desktop-portal-kde

@@ -26,7 +26,7 @@ profile xdg-desktop-portal-kde @{exec_path} {
   @{exec_path} mr,
 
   /usr/share/hwdata/pnp.ids r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
   /usr/share/mime/{,**} r,
   /usr/share/qt5/qtlogging.ini r,
 

apparmor.d/groups/freedesktop/xdg-document-portal

@@ -68,7 +68,7 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
   /dev/fuse rw,
 
   # file inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   profile flatpak {
     include <abstractions/base>

apparmor.d/groups/freedesktop/xdg-email

@@ -23,7 +23,7 @@ profile xdg-email @{exec_path} flags=(complain) {
   @{bin}/which       rix,
   @{bin}/xdg-mime    rPx,
 
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/xdg-email>
 }

apparmor.d/groups/freedesktop/xdg-mime

@@ -39,10 +39,10 @@ profile xdg-mime @{exec_path} flags=(attach_disconnected) {
 
   owner @{run}/user/@{uid}/ r,
 
-  @{sys}/devices/platform/**/hwmon/hwmon[0-9]*/temp* r,
+  @{sys}/devices/platform/**/hwmon/hwmon@{int}/temp* r,
-  @{sys}/devices/platform/**/hwmon/hwmon[0-9]*/fan* r,
+  @{sys}/devices/platform/**/hwmon/hwmon@{int}/fan* r,
 
-  /dev/dri/card[0-9]* rw,
+  /dev/dri/card@{int} rw,
   /dev/tty rw,
 
   # When xdg-mime is run as root, it wants to exec dbus-launch, and hence it creates the two

apparmor.d/groups/freedesktop/xdg-permission-store

@@ -54,7 +54,7 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) {
   owner @{user_share_dirs}/flatpak/db/background rw,
   owner @{user_share_dirs}/flatpak/db/notifications rw,
 
-  /dev/tty[0-9]* rw,
+  /dev/tty@{int} rw,
 
   include if exists <local/xdg-permission-store>
 }

apparmor.d/groups/freedesktop/xdg-screensaver

@@ -35,7 +35,7 @@ profile xdg-screensaver @{exec_path} {
 
   owner @{HOME}/ r,
   owner @{HOME}/.Xauthority r,
-  owner /tmp/xauth-[0-9]*-_[0-9] r,
+  owner /tmp/xauth-@{int}-_[0-9] r,
 
   owner @{run}/user/@{uid}/ r,
 

apparmor.d/groups/freedesktop/xhost

@@ -21,7 +21,7 @@ profile xhost @{exec_path} {
   /tmp/.X11-unix/* rw,
 
   # file_inherit
-  /dev/tty[0-9]* rw,
+  /dev/tty@{int} rw,
   owner @{HOME}/.xsession-errors w,
 
   # Silencer

apparmor.d/groups/freedesktop/xkbcomp

@@ -20,25 +20,25 @@ profile xkbcomp @{exec_path} flags=(attach_disconnected) {
 
   /usr/share/X11/xkb/** r,
 
-  /var/lib/xkb/server-[0-9]*.xkm w,
+  /var/lib/xkb/server-@{int}.xkm w,
-  /var/lib/xkb/compiled/server-[0-9]*.xkm rw,
+  /var/lib/xkb/compiled/server-@{int}.xkm rw,
 
   owner @{HOME}/.Xauthority r,
   owner @{HOME}/*.{xkb,xkm} rw,
 
-  owner @{user_share_dirs}/xorg/Xorg.[0-9].log w,
+  owner @{user_share_dirs}/xorg/Xorg.@{int}.log w,
 
-        /var/lib/gdm{3,}/.local/share/xorg/Xorg.[0-9].log w,
+        /var/lib/gdm{3,}/.local/share/xorg/Xorg.@{int}.log w,
-  owner /var/log/lightdm/x-[0-9]*.log w,
+  owner /var/log/lightdm/x-@{int}.log w,
 
-  owner /tmp/server-[0-9]*.xkm rwk,
+  owner /tmp/server-@{int}.xkm rwk,
 
-  /dev/dri/card[0-9]* rw,
+  /dev/dri/card@{int} rw,
   /dev/tty rw,
-  /dev/tty[0-9]* rw,
+  /dev/tty@{int} rw,
   
-  deny /dev/input/event[0-9]* rw,
+  deny /dev/input/event@{int} rw,
-  deny /var/log/Xorg.[0-9]*.log w,
+  deny /var/log/Xorg.@{int}.log w,
 
   include if exists <local/xkbcomp>
 }

apparmor.d/groups/freedesktop/xorg

@@ -66,8 +66,8 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
   @{lib}/xorg/modules/ r,
   @{lib}/xorg/modules/** mr,
 
-  /var/lib/xkb/server-[0-9]*.xkm rw,
+  /var/lib/xkb/server-@{int}.xkm rw,
-  /var/lib/xkb/compiled/server-[0-9]*.xkm rw,
+  /var/lib/xkb/compiled/server-@{int}.xkm rw,
 
   /usr/share/egl/{,**} rw,
   /usr/share/libinput*/ r,
@@ -140,11 +140,11 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
   @{PROC}/mtrr rw,
 
   /dev/fb[0-9] rw,
-  /dev/input/event[0-9]* rw,
+  /dev/input/event@{int} rw,
   /dev/shm/#@{int} rw,
   /dev/shm/shmfd-* rw,
   /dev/tty rw,
-  /dev/tty[0-9]* rw,
+  /dev/tty@{int} rw,
   /dev/vga_arbiter rw,  # Graphic card modules
 
   include if exists <local/xorg>

apparmor.d/groups/freedesktop/xprop

@@ -25,7 +25,7 @@ profile xprop @{exec_path} {
   owner @{run}/user/@{uid}/xauth_@{rand6} rl,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
   owner @{HOME}/.xsession-errors w,
 
   include if exists <local/xprop>

apparmor.d/groups/freedesktop/xrandr

@@ -17,7 +17,7 @@ profile xrandr @{exec_path} {
   /usr/share/X11/XErrorDB r,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
 
   include if exists <local/xrandr>
 }

apparmor.d/groups/freedesktop/xrdb

@@ -17,7 +17,7 @@ profile xrdb @{exec_path} {
   @{bin}/{,*-}cpp-[0-9]*             rix,
   @{bin}/{,ba,da}sh                  rix,
   @{bin}/cpp                         rix,
-  @{lib}/gcc/*/[0-9]*/cc1            rix,
+  @{lib}/gcc/*/@{int}/cc1            rix,
   @{lib}/llvm-[0-9]*/bin/clang       rix,
 
   /usr/include/stdc-predef.h r,
@@ -40,10 +40,10 @@ profile xrdb @{exec_path} {
   owner /tmp/xauth-[0-9]*-_[0-9] r,
 
   @{run}/sddm/\{@{uuid}\} r,
-  @{run}/sddm/xauth_?????? r,
+  @{run}/sddm/xauth_@{rand6} r,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
   owner @{HOME}/.xsession-errors w,
 
   /dev/tty rw,

apparmor.d/groups/freedesktop/xset

@@ -16,12 +16,12 @@ profile xset @{exec_path} {
   owner @{HOME}/.Xauthority r,
 
   @{run}/sddm/\{@{uuid}\} r,
-  @{run}/sddm/xauth_?????? r,
+  @{run}/sddm/xauth_@{rand6} r,
 
   # file_inherit
-  owner /dev/tty[0-9]* rw,
+  owner /dev/tty@{int} rw,
   owner @{HOME}/.xsession-errors w,
-  deny /dev/dri/card[0-9]* rw,
+  deny /dev/dri/card@{int} rw,
 
   include if exists <local/xset>
 }

apparmor.d/groups/freedesktop/xwayland

@@ -36,7 +36,7 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
 
   owner /var/lib/gdm{3,}/.cache/mesa_shader_cache/index rw,
 
-  owner /tmp/server-[0-9]*.xkm rwk,
+  owner /tmp/server-@{int}.xkm rwk,
   owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} rw,
   owner @{run}/user/@{uid}/xwayland-shared-@{rand6} rw,
 
@@ -45,7 +45,7 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
         @{PROC}/@{pids}/cmdline r,
   owner @{PROC}/@{pids}/comm r,
 
-  /dev/tty[0-9]* rw,
+  /dev/tty@{int} rw,
   /dev/tty rw,
 
   include if exists <local/xwayland>

apparmor.d/groups/gnome/evolution-addressbook-factory

@@ -40,7 +40,7 @@ profile evolution-addressbook-factory @{exec_path} {
   @{exec_path}-subprocess rix,
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
-  /usr/share/icu/[0-9]*.[0-9]*/*.dat r,
+  /usr/share/icu/@{int}.@{int}/*.dat r,
 
   owner @{user_share_dirs}/evolution/{,**} rwk,
   owner @{user_cache_dirs}/evolution/addressbook/{,**} rwk,

apparmor.d/groups/gnome/gdm

@@ -92,7 +92,7 @@ profile gdm @{exec_path} flags=(attach_disconnected) {
   @{run}/gdm{3,}/custom.conf r,
   @{run}/gdm{3,}/gdm.pid rw,
   @{run}/gdm{3,}/greeter/ rw,
-  @{run}/systemd/seats/seat[0-9]* r,
+  @{run}/systemd/seats/seat@{int} r,
   @{run}/systemd/sessions/*     r,
   @{run}/systemd/sessions/*.ref r,
   @{run}/systemd/users/@{uid} r,