feat(dbus): rewrite some dbus rules (3).

apparmor.d/groups/browsers/firefox

@@ -17,6 +17,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/audio>
   include <abstractions/bus/atspi>
+  include <abstractions/bus/rtkit>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
   include <abstractions/dconf-write>
@@ -84,10 +85,6 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
        member=Inhibit
        peer=(name=org.freedesktop.PowerManagement),
 
-  dbus send bus=system path=/org/freedesktop/RealtimeKit1
-       member={Get,MakeThreadHighPriority,MakeThreadRealtime,MakeThreadRealtimeWithPID}
-       peer=(name=org.freedesktop.RealtimeKit1*),
-
   dbus (send, receive) bus=session path=/org/mpris/MediaPlayer2
        interface=org.freedesktop.DBus.Properties
        member={GetAll,PropertiesChanged}
@@ -106,7 +103,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
   dbus send bus=session path=/org/gtk/vfs/metadata
        interface=org.gtk.vfs.Metadata
        member=GetTreeFromDevice
-       peer=(name=:*),
+       peer=(name=:*, label=gvfsd-metadata),
 
   dbus send bus=session path=/org/mozilla/firefox/Remote
        interface=org.mozilla.firefox

apparmor.d/groups/bus/ibus-x11

@@ -28,6 +28,11 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) {
   network inet6 dgram,
   network netlink raw,
 
+  dbus receive bus=session
+       interface=org.freedesktop.DBus.Introspectable
+       member=Introspect
+       peer=(name=:*, label=gnome-shell),
+
   @{exec_path} mr,
 
   /var/lib/gdm{3,}/.config/ibus/bus/ r,

apparmor.d/groups/freedesktop/pipewire

@@ -11,6 +11,7 @@ include <tunables/global>
 profile pipewire @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/audio>
+  include <abstractions/bus/rtkit>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
   include <abstractions/nameservice-strict>
@@ -24,16 +25,6 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
 
   dbus bind bus=session name=org.pulseaudio.Server,
 
-  dbus send bus=system path=/org/freedesktop/RealtimeKit1
-       interface=org.freedesktop.RealtimeKit1
-       member=MakeThread*
-       peer=(name=org.freedesktop.RealtimeKit1),
-
-  dbus send bus=system path=/org/freedesktop/RealtimeKit1
-       interface=org.freedesktop.DBus.Properties
-       member=Get
-       peer=(name=org.freedesktop.RealtimeKit1),
-
   dbus send bus=session path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
        member={GetConnectionUnixUser,GetConnectionUnixProcessID}

apparmor.d/groups/freedesktop/pipewire-media-session

@@ -11,6 +11,7 @@ include <tunables/global>
 profile pipewire-media-session @{exec_path} {
   include <abstractions/base>
   include <abstractions/audio>
+  include <abstractions/bus/rtkit>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
   include <abstractions/devices-usb>
@@ -22,16 +23,6 @@ profile pipewire-media-session @{exec_path} {
   network bluetooth stream,
   network netlink raw,
 
-  dbus send bus=system path=/org/freedesktop/RealtimeKit1
-       interface=org.freedesktop.DBus.Properties
-       member=Get
-       peer=(name=org.freedesktop.RealtimeKit1),
-
-  dbus send bus=system path=/org/freedesktop/RealtimeKit1
-       interface=org.freedesktop.RealtimeKit1
-       member=MakeThreadRealtime
-       peer=(name=org.freedesktop.RealtimeKit1),
-
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect

apparmor.d/groups/freedesktop/pulseaudio

@@ -12,6 +12,7 @@ include <tunables/global>
 profile pulseaudio @{exec_path} {
   include <abstractions/base>
   include <abstractions/audio>
+  include <abstractions/bus/rtkit>
   include <abstractions/consoles>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
@@ -73,10 +74,6 @@ profile pulseaudio @{exec_path} {
        member=Introspect
        peer=(name=:*, label=gnome-shell),
 
-  dbus send bus=system path=/org/freedesktop/RealtimeKit1
-       member={Get,MakeThreadHighPriority,MakeThreadRealtime}
-       peer=(name=org.freedesktop.RealtimeKit1),
-
   dbus send bus=system path=/
        interface=org.freedesktop.DBus.ObjectManager
        member=GetManagedObjects

apparmor.d/groups/freedesktop/xdg-desktop-portal

@@ -24,10 +24,13 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
   dbus bind bus=session name=org.freedesktop.portal.Desktop,
   dbus receive bus=session path=/org/freedesktop/portal/desktop
        interface=org.freedesktop.portal.Settings
-       peer=(name=:*, label=nautilus),
+       peer=(name=:*),
   dbus send bus=session path=/org/freedesktop/portal/desktop
        interface=org.freedesktop.DBus.Properties
        peer=(name=:*),
+  dbus send bus=session path=/org/freedesktop/portal/desktop
+       interface=org.freedesktop.impl.portal.Settings
+       peer=(name=:*),
 
   dbus bind bus=session name=org.freedesktop.background.Monitor,
   dbus receive bus=session path=/org/freedesktop/background/monitor

apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{lib}/xdg-desktop-portal-gnome
 profile xdg-desktop-portal-gnome @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus/account-daemon>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
   include <abstractions/dconf-write>
@@ -28,18 +29,6 @@ profile xdg-desktop-portal-gnome @{exec_path} {
 
   dbus bind bus=session name=org.freedesktop.impl.portal.desktop.gnome,
 
-  dbus send bus=system path=/org/freedesktop/Accounts/User[0-9]*
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll,
-
-  dbus receive bus=system path=/org/freedesktop/Accounts/User[0-9]*
-       interface=org.freedesktop.DBus.Properties
-       member=PropertiesChanged,
-
-  dbus receive bus=system path=/org/freedesktop/Accounts/User[0-9]*
-       interface=org.freedesktop.Accounts.User
-       member=Changed,
-
   dbus send bus=session path=/org/gnome/Shell/Screenshot
        interface=org.freedesktop.DBus.Properties
        member=GetAll
@@ -85,15 +74,12 @@ profile xdg-desktop-portal-gnome @{exec_path} {
        member=Read
        peer=(name=:*, label=xdg-desktop-portal),
 
-  dbus receive bus=session path=/org/gnome/Mutter/DisplayConfig
+  dbus (send, receive) bus=session path=/org/gnome/Mutter/*
-       interface=org.gnome.Mutter.DisplayConfig
+       interface=org.gnome.Mutter.*
-       member=GetCurrentState
        peer=(name=:*, label="{gnome-shell,gsd-xsettings}"),
-
   dbus send bus=session path=/org/gnome/Mutter/*
        interface=org.freedesktop.DBus.Properties
-       member=GetAll
+       peer=(name=:*, label="{gnome-shell,gsd-xsettings}"),
-       peer=(name=:*, label=gnome-shell),
 
   dbus send bus=session path=/org/gtk/vfs/mounttracker
        interface=org.gtk.vfs.MountTracker

apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{lib}/xdg-desktop-portal-gtk
 profile xdg-desktop-portal-gtk @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus/account-daemon>
   include <abstractions/bus/atspi>
   include <abstractions/bus/vfs>
   include <abstractions/dbus-accessibility-strict>
@@ -32,31 +33,6 @@ profile xdg-desktop-portal-gtk @{exec_path} {
 
   dbus bind bus=session name=org.freedesktop.impl.portal.desktop.gtk,
 
-  dbus send bus=system path=/org/freedesktop/Accounts/User@{int}
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll,
-
-  dbus receive bus=system path=/org/freedesktop/Accounts/User@{int}
-       interface=org.freedesktop.DBus.Properties
-       member=PropertiesChanged,
-
-  dbus receive bus=system path=/org/freedesktop/Accounts/User@{int}
-       interface=org.freedesktop.Accounts.User
-       member=Changed,
-
-  dbus receive bus=system path=/org/freedesktop/NetworkManager
-       interface=org.freedesktop.NetworkManager
-       member=CheckPermissions,
-
-  dbus receive bus=system path=/org/freedesktop/NetworkManager
-       interface=org.freedesktop.DBus.Properties
-       member=PropertiesChanged,
-
-  dbus send bus=session path=/org/gtk/Settings
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll
-       peer=(name=:*, label=gsd-xsettings),
-
   dbus send bus=session path=/org/gnome/SessionManager
        interface=org.gnome.SessionManager
        member=RegisterClient
@@ -121,6 +97,11 @@ profile xdg-desktop-portal-gtk @{exec_path} {
        member=GetAll
        peer=(name=:*, label=gnome-shell),
 
+  dbus receive bus=session
+       interface=org.freedesktop.DBus.Introspectable
+       member=Introspect
+       peer=(name=:*, label=gnome-shell),
+
   @{exec_path} mr,
 
   /usr/share/X11/xkb/{,**} r,

apparmor.d/groups/gnome/gdm-session-worker

@@ -10,6 +10,7 @@ include <tunables/global>
 profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/authentication>
+  include <abstractions/bus/account-daemon>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
   include <abstractions/nameservice-strict>
@@ -46,18 +47,15 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
 
   network netlink raw,
 
-  dbus (send,receive) bus=system path=/org/freedesktop/Accounts{,/User[0-9]*}
-       interface=org.freedesktop.{DBus.Properties,Accounts*}
-       member={GetAll,FindUserByName,SetLanguage,Changed,PropertiesChanged},
-
-  dbus receive bus=system path=/org/freedesktop/Accounts
-       interface=org.freedesktop.Accounts
-       member=UserAdded
-       peer=(name=:*, label=accounts-daemon),
-
   dbus send bus=system path=/org/freedesktop/login1
        interface=org.freedesktop.login1.Manager
-       member={CreateSession,ReleaseSession},
+       member=*Session
+       peer=(name=org.freedesktop.login1, label=systemd-logind),
+
+  dbus send bus=system path=/org/freedesktop/Accounts/User@{uid}
+       interface=org.freedesktop.Accounts.User
+       member=SetLanguage
+       peer=(name=:*, label=accounts-daemon),
 
   @{exec_path} mrix,
 

apparmor.d/groups/gnome/gjs-console

@@ -44,6 +44,9 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
   dbus send bus=session path=/org/gnome/ScreenSaver
        interface=org.gnome.ScreenSaver
        peer=(name=:*), # all members
+  dbus send bus=session path=/org/gnome/ScreenSaver
+       interface=org.gnome.ScreenSaver
+       peer=(name=org.freedesktop.DBus),
   dbus send bus=session path=/org/gnome/ScreenSaver
        interface=org.freedesktop.DBus.Properties
        peer=(name=:*), # all members

apparmor.d/groups/gnome/gnome-extension-ding

@@ -75,8 +75,8 @@ profile gnome-extension-ding @{exec_path} {
        member=Introspect
        peer=(name=:*, label=nautilus),
 
-  dbus send bus=session path=/org/freedesktop/DBus
+  dbus send bus={systemd,session} path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
+       interface=org.freedesktop.DBus{,.Properties}
        peer=(name=org.freedesktop.DBus, label=dbus-daemon),
 
   @{exec_path} mr,

apparmor.d/groups/gnome/gnome-shell

@@ -11,7 +11,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/app-launcher-user>
   include <abstractions/audio>
+  include <abstractions/bus/account-daemon>
   include <abstractions/bus/atspi>
+  include <abstractions/bus/upower>
   include <abstractions/bus/network-manager>
   include <abstractions/bus/polkit>
   include <abstractions/bus/vfs>

apparmor.d/groups/gnome/gnome-terminal-server

@@ -23,6 +23,15 @@ profile gnome-terminal-server @{exec_path} {
   ptrace (read) peer=unconfined,
 
   dbus bind bus=session name=org.gnome.Terminal,
+  dbus receive bus=session path=/org/gnome/Terminal{,/**}
+       interface=org.gnome.Terminal.*
+       peer=(name=:*),
+  dbus receive bus=session path=/org/gnome/Terminal{,/**}
+       interface=org.freedesktop.DBus.Properties
+       peer=(name=:*, label=unconfined),
+  dbus receive bus=session path=/org/gnome/Terminal{,/**}
+       interface=org.gtk.Actions
+       peer=(name=:*),
 
   @{exec_path} mr,
 

apparmor.d/groups/gnome/goa-daemon

@@ -9,7 +9,7 @@ include <tunables/global>
 @{exec_path} = @{lib}/goa-daemon
 profile goa-daemon @{exec_path} {
   include <abstractions/base>
-  include <abstractions/dbus-network-manager-strict>
+  include <abstractions/bus/network-manager>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
   include <abstractions/dconf-write>
@@ -25,10 +25,10 @@ profile goa-daemon @{exec_path} {
   network inet6 dgram,
   network netlink raw,
 
-  dbus send bus=session path=/org/freedesktop/DBus
+  dbus bind bus=session name=org.gnome.OnlineAccounts,
-       interface=org.freedesktop.DBus
+  dbus receive bus=session path=/org/gnome/OnlineAccounts
-       member={RequestName,ReleaseName}
+       interface=org.freedesktop.DBus.ObjectManager
-       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
+       peer=(name=:*),
 
   dbus (send,receive) bus=system path=/org/freedesktop/NetworkManager
        interface=org.freedesktop.DBus.Properties
@@ -52,14 +52,6 @@ profile goa-daemon @{exec_path} {
        member=Introspect
        peer=(name=:*, label=gnome-shell),
 
-  dbus send bus=session path=/org/gnome/Identity/Manager
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll
-       peer=(name=:*, label=goa-identity-service),
-
-  dbus bind bus=session
-       name=org.gnome.OnlineAccounts,
-
   @{exec_path} mr,
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,

apparmor.d/groups/gnome/gsd-power

@@ -11,6 +11,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/audio>
   include <abstractions/bus/atspi>
+  include <abstractions/bus/upower>
   include <abstractions/bus/vfs>
   include <abstractions/dbus-accessibility-strict>
   include <abstractions/dbus-session-strict>

apparmor.d/groups/gnome/gsd-xsettings

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{lib}/gsd-xsettings
 profile gsd-xsettings @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus/account-daemon>
   include <abstractions/bus/atspi>
   include <abstractions/dbus-accessibility-strict>
   include <abstractions/dbus-session-strict>
@@ -38,11 +39,6 @@ profile gsd-xsettings @{exec_path} {
        member=GetAll
        peer=(name=:*), # many peer's labels
 
-  dbus receive bus=system path=/org/freedesktop/Accounts
-       interface=org.freedesktop.Accounts
-       member={UserAdded,UserRemoved}
-       peer=(name=:*, label=accounts-daemon),
-
   dbus receive bus=session path=/org/gnome/SessionManager
        interface=org.gnome.SessionManager
        member={ClientAdded,ClientRemoved,SessionRunning}

apparmor.d/groups/gnome/tracker-miner

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{lib}/tracker-miner-fs-{,control-}3
 profile tracker-miner @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/bus/upower>
   include <abstractions/bus/vfs>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
@@ -27,15 +28,11 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
 
   dbus (send, receive) bus=session path=/org/freedesktop/Tracker3/**
        interface=org.freedesktop.Tracker3.*
-       peer=(name=:*), # all members
+       peer=(name="{:*,org.freedesktop.DBus}"), # all members
   dbus receive bus=session path=/org/freedesktop/Tracker3/**
        interface=org.freedesktop.DBus.{Peer,Properties}
        peer=(name=:*),
 
-  dbus send bus=system path=/org/freedesktop/UPower{,/devices/DisplayDevice}
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll,
-
   dbus send bus=session path=/org/gtk/vfs/Daemon
        interface=org.gtk.vfs.Daemon
        member={ListMonitorImplementations,ListMountableInfo}

apparmor.d/groups/kde/plasmashell

@@ -11,6 +11,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
   include <abstractions/base>
   include <abstractions/app-launcher-user>
   include <abstractions/audio>
+  include <abstractions/bus/upower>
   include <abstractions/consoles>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
@@ -45,11 +46,6 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
 
   signal (send),
 
-  dbus (send,receive) bus=system path=/org/freedesktop/UPower/devices/{,DisplayDevice,battery_BAT[0-9]*,mouse_hidpp_battery_[0-9]*}
-       interface=org.freedesktop.DBus.Properties
-       member={GetAll,PropertiesChanged}
-       peer=(label=upowerd),
-
   @{exec_path} mr,
 
   @{lib}/libheif/            r,

apparmor.d/groups/network/ModemManager

@@ -20,8 +20,7 @@ profile ModemManager @{exec_path} flags=(attach_disconnected) {
 
   dbus bind bus=system name=org.freedesktop.ModemManager1,
   dbus receive bus=system path=/org/freedesktop/ModemManager1
-       interface=org.freedesktop.DBus.Properties
+       interface=org.freedesktop.DBus.{ObjectManager,Properties}
-       member=GetManagedObjects
        peer=(name=:*),
 
   dbus (send, receive) bus=system path=/org/freedesktop/login1

apparmor.d/groups/network/NetworkManager

@@ -39,43 +39,36 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
   signal (send) set=(term) peer=dnsmasq,
 
   dbus bind bus=system name=org.freedesktop.NetworkManager,
-
+  dbus receive bus=system path=/org/freedesktop/NetworkManager{,/**}
-  dbus (send,receive) bus=system path=/org/freedesktop/NetworkManager{,/**}
+       interface=org.freedesktop.NetworkManager{,.*}
-       interface=org.freedesktop.{DBus.Properties,DBus.Introspectable,NetworkManager*}
        peer=(name=:*),
+  dbus receive bus=system path=/org/freedesktop/NetworkManager{,/**}
+       interface=org.freedesktop.DBus.Properties
+       peer=(name=:*),
+  dbus send bus=system path=/org/freedesktop/NetworkManager{,/**}
+       interface=org.freedesktop.DBus.Properties
+       member=PropertiesChanged
+       peer=(name=org.freedesktop.DBus),
 
-  dbus (send,receive) bus=system path=/org/freedesktop/login1
+  dbus receive bus=system path=/org/freedesktop
-       interface=org.freedesktop.login1.Manager
-       member={SessionRemoved,UserNew,SessionNew,Inhibit,PrepareForShutdown,UserRemoved,PrepareForSleep}
-       peer=(name=:*, label=systemd-logind),
-
-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID}
-       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
-
-  dbus send bus=system path=/org/freedesktop
        interface=org.freedesktop.DBus.ObjectManager
-       member={InterfacesAdded,InterfacesRemoved}
+       member=GetManagedObjects
-       peer=(name=org.freedesktop.DBus), # label="{gnome-shell,...}"
+       peer=(name=:*),
 
   dbus send bus=system path=/org/freedesktop/nm_dispatcher
        interface=org.freedesktop.nm_dispatcher
        member=Action
        peer=(name=org.freedesktop.nm_dispatcher),
 
-  dbus send bus=system path=/org/freedesktop/ModemManager1
-       interface=org.freedesktop.DBus.ObjectManager
-       member=GetManagedObjects,
-
   dbus send bus=system path=/org/freedesktop/resolve1
        interface=org.freedesktop.resolve1.Manager
-       member={SetLink*,ResolveHostname},
+       member={SetLink*,ResolveHostname}
-       # org.freedesktop.resolve1
+       peer=(name=org.freedesktop.resolve1, label=systemd-resolved),
 
   dbus send bus=system path=/org/freedesktop/hostname1
        interface=org.freedesktop.DBus.Properties
-       member=GetAll,
+       member=GetAll
+       peer=(name=:*, label=systemd-hostnamed),
 
   dbus send bus=system path=/org/freedesktop/ModemManager1
        interface=org.freedesktop.DBus.ObjectManager
@@ -86,13 +79,19 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
        member=PropertiesChanged 
        peer=(name=:*, label=wpa-supplicant),
 
-  dbus receive bus=system path=/org/freedesktop
+  dbus receive bus=system path=/org/freedesktop/login1
-       interface=org.freedesktop.DBus.ObjectManager
+       interface=org.freedesktop.login1.Manager
-       member=GetManagedObjects,
+       peer=(name=:*, label=systemd-logind),
 
-  dbus receive bus=system path=/org/bluez/hci*/**
+  dbus receive bus=system path=/org/bluez/hci@{int}{,/**}
        interface=org.freedesktop.DBus.Properties
-       peer=(name=:*),
+       member=PropertiesChanged
+       peer=(name=:*, label=bluetoothd),
+
+  dbus send bus=system path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus
+       member={GetConnectionUnixUser,GetConnectionUnixProcessID}
+       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
 
   @{exec_path} mr,
 

apparmor.d/groups/systemd/systemd-logind

@@ -27,18 +27,18 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
   network netlink raw,
 
   dbus bind bus=system name=org.freedesktop.login1,
-  dbus receive bus=system path=/org/freedesktop/login1{,/**}
+  dbus (send, receive) bus=system path=/org/freedesktop/login1{,/**}
-       interface=org.freedesktop.login1.Manager
+       interface=org.freedesktop.login1.*
        peer=(name=:*),
   dbus receive bus=system path=/org/freedesktop/login1{,/**}
        interface=org.freedesktop.DBus.Properties
        peer=(name=:*),
+  dbus (send, receive) bus=system path=/org/freedesktop/login1{,/**}
+       interface=org.freedesktop.login1.*
+       peer=(name=org.freedesktop.DBus),
   dbus send bus=system path=/org/freedesktop/login1{,/**}
        interface=org.freedesktop.DBus.Properties
        peer=(name=org.freedesktop.DBus),
-  dbus send bus=system path=/org/freedesktop/login1
-       interface=org.freedesktop.login1.Manager
-       peer=(name=org.freedesktop.DBus),
 
   dbus receive bus=system path=/org/freedesktop/systemd1/{unit,job}/**
        interface=org.freedesktop.DBus.Properties
@@ -56,7 +56,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
 
   dbus send bus=system path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
-       member={GetConnectionUnixUser,GetConnectionUnixProcessID}
+       member={GetConnectionUnixUser,GetConnectionUnixProcessID,GetConnectionCredentials}
        peer=(name=org.freedesktop.DBus, label=dbus-daemon),
 
   @{exec_path} mr,

apparmor.d/profiles-a-f/fwupd

@@ -11,6 +11,7 @@ include <tunables/global>
 profile fwupd @{exec_path} flags=(complain,attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus/polkit>
+  include <abstractions/bus/upower>
   include <abstractions/consoles>
   include <abstractions/dbus-strict>
   include <abstractions/disks-read>
@@ -34,6 +35,14 @@ profile fwupd @{exec_path} flags=(complain,attach_disconnected) {
   dbus receive bus=system path=/
        interface=org.freedesktop.fwupd
        peer=(name=:*, label=fwupdmgr),
+  dbus receive bus=system path=/
+       interface=org.freedesktop.DBus.Properties
+       member={GetAll,SetHints,GetPlugins,GetRemotes}
+       peer=(name=:*, label=fwupdmgr),
+  dbus send bus=system path=/
+       interface=org.freedesktop.DBus
+       member=Changed
+       peer=(name=:*, label=fwupdmgr),
 
   dbus send bus=system path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
@@ -52,20 +61,6 @@ profile fwupd @{exec_path} flags=(complain,attach_disconnected) {
        interface=org.freedesktop.{DBus.Properties,UDisks2.Manager}
        member={GetAll,GetBlockDevices},
 
-  dbus send bus=system path=/org/freedesktop/UPower{,/devices/DisplayDevice}
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll,
-
-  dbus send bus=system path=/
-       interface=org.freedesktop.DBus
-       member=Changed
-       peer=(label=fwupdmgr),
-
-  dbus receive bus=system path=/
-       interface=org.freedesktop.DBus.Properties
-       member={GetAll,SetHints,GetPlugins,GetRemotes}
-       peer=(name=:*, label=fwupdmgr),
-
   @{exec_path} mr,
 
   @{lib}/fwupd/fwupd-detect-cet rix,

apparmor.d/profiles-s-z/spice-vdagent

@@ -13,6 +13,7 @@ profile spice-vdagent @{exec_path} {
   include <abstractions/bus/atspi>
   include <abstractions/dbus-accessibility-strict>
   include <abstractions/dbus-session-strict>
+  include <abstractions/dbus-strict>
   include <abstractions/dri-common>
   include <abstractions/fontconfig-cache-write>
   include <abstractions/fonts>
@@ -25,6 +26,16 @@ profile spice-vdagent @{exec_path} {
        member=GetCurrentState
        peer=(name=:*, label=gnome-shell),
 
+  dbus send bus=session path=/org/freedesktop/portal/desktop
+       interface=org.freedesktop.DBus.Properties
+       member=Get
+       peer=(name=org.freedesktop.portal.Desktop, label=xdg-desktop-portal),
+
+  dbus send bus=session path=/org/freedesktop/portal/desktop
+       interface=org.freedesktop.portal.Realtime
+       member=MakeThreadRealtimeWithPID
+       peer=(name=org.freedesktop.portal.Desktop, label=xdg-desktop-portal),
+
   dbus receive bus=session path=/
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect 

apparmor.d/profiles-s-z/thermald

@@ -11,6 +11,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/thermald
 profile thermald @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/bus/upower>
   include <abstractions/dbus-strict>
 
   capability sys_boot,
@@ -22,11 +23,6 @@ profile thermald @{exec_path} flags=(attach_disconnected) {
        member=GetAll 
        peer=(name=:*, label=power-profiles-daemon),
 
-  dbus send bus=system path=/org/freedesktop/UPower
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll 
-       peer=(name=:*, label=upowerd),
-
   @{exec_path} mr,
 
   /etc/thermald/thermal-conf.xml r,

apparmor.d/profiles-s-z/thunderbird

@@ -17,6 +17,7 @@ profile thunderbird @{exec_path} {
   include <abstractions/base>
   include <abstractions/audio>
   include <abstractions/bus/atspi>
+  include <abstractions/bus/rtkit>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
   include <abstractions/dconf-write>
@@ -50,15 +51,6 @@ profile thunderbird @{exec_path} {
 
   dbus bind bus=session name=org.mozilla.thunderbird.*,
 
-  dbus send bus=system path=/org/freedesktop/RealtimeKit1
-       member={Get,MakeThreadHighPriority,MakeThreadRealtime}
-       peer=(name=org.freedesktop.RealtimeKit1*),
-
-  dbus send bus=system path=/org/freedesktop/UPower
-       interface=org.freedesktop.UPower
-       member=EnumerateDevices
-       peer=(name=org.freedesktop.UPower),
-
   dbus send bus=session path=/org/freedesktop/portal/desktop
        interface=org.freedesktop.DBus.Properties
        member=GetAll

apparmor.d/profiles-s-z/wireplumber

@@ -1,5 +1,5 @@
 # apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -10,6 +10,8 @@ include <tunables/global>
 profile wireplumber @{exec_path} {
   include <abstractions/base>
   include <abstractions/audio>
+  include <abstractions/bus/rtkit>
+  include <abstractions/bus/upower>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
   include <abstractions/devices-usb>
@@ -23,19 +25,6 @@ profile wireplumber @{exec_path} {
 
   dbus bind bus=session name=org.freedesktop.ReserveDevice1.Audio0,
 
-  dbus send bus=system path=/org/freedesktop/RealtimeKit1
-       interface=org.freedesktop.RealtimeKit1
-       peer=(name=org.freedesktop.RealtimeKit1, label=rtkit-daemon),
-
-  dbus send bus=system path=/org/freedesktop/UPower/devices/DisplayDevice
-       interface=org.freedesktop.DBus.Properties
-       peer=(name=org.freedesktop.UPower, label=upowerd),
-
-  dbus send bus=system path=/org/freedesktop/RealtimeKit1
-       interface=org.freedesktop.DBus.Properties
-       member=Get
-       peer=(name=org.freedesktop.RealtimeKit1, label=rtkit-daemon),
-
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect