feat(profile): general update.

apparmor.d/abstractions/bus/org.freedesktop.RealtimeKit1

@@ -14,7 +14,12 @@
 
   dbus send bus=system path=/org/freedesktop/RealtimeKit1
        interface=org.freedesktop.RealtimeKit1
-       member=MakeThread*
-       peer=(name="{:*,org.freedesktop.RealtimeKit1}", label=rtkit-daemon),
+       member={MakeThreadRealtime,MakeThreadHighPriority}
+       peer=(name=:*, label=rtkit-daemon),
+
+  dbus send bus=system path=/org/freedesktop/RealtimeKit1
+       interface=org.freedesktop.RealtimeKit1
+       member={MakeThreadRealtime,MakeThreadHighPriority}
+       peer=(name=org.freedesktop.RealtimeKit1),
 
   include if exists <abstractions/bus/org.freedesktop.RealtimeKit1.d>

apparmor.d/groups/freedesktop/dconf-editor

@@ -16,6 +16,8 @@ profile dconf-editor @{exec_path} {
 
   @{exec_path} mr,
 
+  @{open_path}  rPx -> child-open-help,
+
   # When GSETTINGS_BACKEND=keyfile
   owner @{user_config_dirs}/glib-2.0/ rw,
   owner @{user_config_dirs}/glib-2.0/settings/ rw,

apparmor.d/groups/freedesktop/pulseaudio

@@ -62,22 +62,11 @@ profile pulseaudio @{exec_path} {
        member=GetManagedObjects
        peer=(name=org.bluez),
 
-  dbus send bus=system path=/
-       interface=org.freedesktop.DBus.Peer
-       member=Ping
-       peer=(name=org.freedesktop.Avahi, label=avahi-daemon),
-
   dbus send bus=system path=/Client@{int}/ServiceResolver@{int}
        interface=org.freedesktop.Avahi.ServiceResolver
        member={Found,Free}
        peer=(name=org.freedesktop.Avahi, label=avahi-daemon),
 
-  # No label in rule
-  dbus send bus=system path=/org/freedesktop/RealtimeKit@{int}
-       interface=org.freedesktop.RealtimeKit@{int}
-       member=MakeThreadHighPriority
-       peer=(name=org.freedesktop.RealtimeKit@{int}),
-
   @{exec_path} mrix,
 
   @{lib}/pulse/gsettings-helper rix,

apparmor.d/groups/gnome/loupe

@@ -34,6 +34,7 @@ profile loupe @{exec_path} flags=(attach_disconnected) {
   @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r,
 
   owner @{PROC}/@{pid}/cgroup r,
+  owner @{PROC}/@{pid}/cmdline r,
 
   deny @{user_share_dirs}/gvfs-metadata/* r,
 

apparmor.d/groups/ubuntu/notify-reboot-required

@@ -6,7 +6,7 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-@{exec_path} = /usr/share/update-notifier/notify-reboot-required
+@{exec_path} = /usr/share/{update,reboot}-notifier/notify-reboot-required
 profile notify-reboot-required @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
@@ -17,7 +17,7 @@ profile notify-reboot-required @{exec_path} {
   @{bin}/gettext     rix,
   @{bin}/snap       rPUx,
 
-  /usr/share/update-notifier/notify-reboot-required r,
+  /usr/share/{update,reboot}-notifier/notify-reboot-required r,
 
   @{run}/reboot-required rw,
   @{run}/reboot-required.pkgs rw,

apparmor.d/profiles-a-f/element-desktop

@@ -15,6 +15,9 @@ include <tunables/global>
 profile element-desktop @{exec_path} {
   include <abstractions/base>
   include <abstractions/audio-client>
+  include <abstractions/bus-session>
+  include <abstractions/bus/org.freedesktop.ScreenSaver>
+  include <abstractions/bus/org.kde.StatusNotifierWatcher>
   include <abstractions/common/electron>
   include <abstractions/p11-kit>
   include <abstractions/video>

apparmor.d/profiles-a-f/evince

@@ -12,7 +12,9 @@ profile evince @{exec_path} {
   include <abstractions/bus-accessibility>
   include <abstractions/bus-session>
   include <abstractions/bus/org.a11y>
+  include <abstractions/bus/org.freedesktop.FileManager1>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
+  include <abstractions/bus/org.gnome.SessionManager>
   include <abstractions/dconf-write>
   include <abstractions/gnome-strict>
   include <abstractions/ibus>
@@ -26,7 +28,9 @@ profile evince @{exec_path} {
   deny network inet,
   deny network inet6,
 
-  #aa:dbus own bus=session name=org.gnome.evince.Daemon
+  #aa:dbus own bus=session name=org.gnome.evince
+
+  #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.MediaKeys label=gsd-media-keys
 
   dbus send bus=session path=/org/gtk/vfs/metadata
        interface=org.gtk.vfs.Metadata

apparmor.d/profiles-s-z/syncthing

@@ -24,7 +24,7 @@ profile syncthing @{exec_path} {
   @{open_path}     rPx -> child-open,
   @{bin}/ip        rix,
 
-  /usr/share/mime/{,*} r,
+  /usr/share/mime/{,**} r,
 
   /etc/mime.types r,
 

apparmor.d/profiles-s-z/udisksd

@@ -101,8 +101,7 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
   @{MOUNTS}/*/ rw,
 
   @{run}/ r,
-  @{run}/mount/utab{,.*} rw,
-  @{run}/mount/utab.lock rwk,
+  @{run}/mount/utab{,.*} rwk,
   @{run}/udisks2/{,**} rw,
   @{run}/systemd/seats/seat@{int} r,
   @{run}/systemd/inhibit/[0-9]*.ref rw,

apparmor.d/profiles-s-z/vlc

@@ -15,6 +15,9 @@ profile vlc @{exec_path} {
   include <abstractions/bus-session>
   include <abstractions/bus/org.a11y>
   include <abstractions/bus/org.freedesktop.ScreenSaver>
+  include <abstractions/bus/org.freedesktop.secrets>
+  include <abstractions/bus/org.kde.kwalletd>
+  include <abstractions/bus/org.kde.StatusNotifierWatcher>
   include <abstractions/dconf-write>
   include <abstractions/desktop>
   include <abstractions/devices-usb>
@@ -32,54 +35,8 @@ profile vlc @{exec_path} {
   network inet6 stream,
   network netlink raw,
 
-  dbus bind bus=session name=org.kde.StatusNotifierItem-*,
-
-  dbus bind bus=session name=org.mpris.MediaPlayer2.vlc*,
-  dbus (send, receive) bus=session path=/org/mpris/MediaPlayer2
-       interface=org.freedesktop.DBus.Properties
-       peer=(name="{org.freedesktop.DBus,:*}"), # all members
-  dbus (send, receive) bus=session path=/org/mpris/MediaPlayer2
-       interface=org.mpris.MediaPlayer2.*
-       peer=(name="{org.mpris.MediaPlayer2.vlc,org.freedesktop.DBus,:*}"), # all members
-
-  dbus send bus=session path=/StatusNotifierWatcher
-       interface=org.freedesktop.DBus.Introspectable
-       member=Introspect
-       peer=(name=org.kde.StatusNotifierWatcher),
-
-  dbus send bus=session path=/StatusNotifierWatcher
-       interface=org.freedesktop.DBus.Properties
-       member={Get,RegisterStatusNotifierItem}
-       peer=(name=org.kde.StatusNotifierWatcher),
-
-  dbus send bus=session path=/StatusNotifierWatcher
-       interface=org.kde.StatusNotifierWatcher
-       member=RegisterStatusNotifierItem
-       peer=(name=org.kde.StatusNotifierWatcher),
-
-  dbus send bus=session path=/StatusNotifierItem 
-       interface=org.kde.StatusNotifierItem
-       member={NewToolTip,NewStatus,NewAttentionIcon,NewTitle,NewStatus,NewIcon}
-       peer=(name=org.freedesktop.DBus),
-
-  dbus receive bus=session path=/StatusNotifierItem 
-       interface=org.kde.StatusNotifierItem
-       member=Activate
-       peer=(name=:*),
-
-  dbus receive bus=session path=/StatusNotifierItem
-       interface=org.freedesktop.DBus.Properties
-       member={Get,GetAll}
-       peer=(name=:*),
-
-  dbus send bus=session path=/MenuBar
-       interface=com.canonical.dbusmenu
-       member={LayoutUpdated,ItemsPropertiesUpdated}
-       peer=(name=org.freedesktop.DBus),
-
-  dbus (send receive) bus=session path=/MenuBar
-       interface=com.canonical.dbusmenu
-       peer=(name=:*),
+  #aa:dbus own bus=session name=org.mpris.MediaPlayer2.vlc
+  #aa:dbus talk bus=session name=org.mpris.MediaPlayer2.Player label=unconfined
 
   @{exec_path} mrix,