feat(profile): use the new @{tmp} variable.

It is only used with the owner statement.

apparmor.d/abstractions/X-strict

@@ -19,7 +19,7 @@
         /tmp/.ICE-unix/* rw,
         /tmp/.X@{int}-lock rw,
         /tmp/.X11-unix/* rw,
-  owner /tmp/xauth_@{rand6} rl -> /tmp/#@{int},
+  owner @{tmp}/xauth_@{rand6} rl -> /tmp/#@{int},
 
   owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} rw,  # Xwayland
   owner @{run}/user/@{uid}/gdm{[1-9],}/Xauthority r,

apparmor.d/abstractions/app/chromium

@@ -151,17 +151,13 @@
 
         /tmp/ r,
         /var/tmp/ r,
-  owner /tmp/.@{domain}.* rw,
-  owner /tmp/.@{domain}*/{,**} rw,
-  owner /tmp/@{name}-crashlog-@{int}-@{int}.txt rw,
-  owner /tmp/scoped_dir*/{,**} rw,
-  owner /tmp/tmp.* rw,
-  owner /tmp/tmp.*/ rw,
-  owner /tmp/tmp.*/** rwk,
-
-  # libpam-tmpdir support
-  owner /tmp/user/@{uid}/ rw, 
-  owner /tmp/user/@{uid}/** rwk,
+  owner @{tmp}/.@{domain}.* rw,
+  owner @{tmp}/.@{domain}*/{,**} rw,
+  owner @{tmp}/@{name}-crashlog-@{int}-@{int}.txt rw,
+  owner @{tmp}/scoped_dir*/{,**} rw,
+  owner @{tmp}/tmp.* rw,
+  owner @{tmp}/tmp.*/ rw,
+  owner @{tmp}/tmp.*/** rwk,
 
         /dev/shm/ r,
   owner /dev/shm/.@{domain}* rw,

apparmor.d/abstractions/bus-session

@@ -19,8 +19,8 @@
   /etc/machine-id r,
   /var/lib/dbus/machine-id r,
 
-  owner /tmp/dbus-@{rand8} rw,
-  owner /tmp/dbus-@{rand10} rw,
+  owner @{tmp}/dbus-@{rand8} rw,
+  owner @{tmp}/dbus-@{rand10} rw,
 
   owner @{run}/user/@{uid}/bus rw,
 

apparmor.d/abstractions/common/app

@@ -53,7 +53,7 @@
   owner @{user_share_dirs}/** rwkl,
   owner @{user_games_dirs}/{,**} rm,
 
-  owner /tmp/** rmwk,
+  owner @{tmp}/** rmwk,
   owner /dev/shm/** rwlk -> /dev/shm/**,
 
   @{run}/cups/cups.sock rw, # Allow access to cups printing socket.

apparmor.d/abstractions/common/apt

@@ -25,8 +25,7 @@
   /var/lib/dpkg/status r,
   /var/lib/ubuntu-advantage/apt-esm/{,**} r,
 
-  owner /tmp/#@{int} rw,
-  owner /tmp/clearsigned.message.* rw,
-  owner /tmp/user/@{uid}/#@{int} rw,
+  owner @{tmp}/#@{int} rw,
+  owner @{tmp}/clearsigned.message.* rw,
 
   include if exists <abstractions/common/apt.d>

apparmor.d/abstractions/common/bwrap

@@ -37,8 +37,8 @@
   owner / r,
   owner /newroot/{,**} w,
 
-  owner /tmp/newroot/ w,
-  owner /tmp/oldroot/ w,
+  owner @{tmp}/newroot/ w,
+  owner @{tmp}/oldroot/ w,
 
         @{PROC}/sys/kernel/overflowgid r,
         @{PROC}/sys/kernel/overflowuid r,

apparmor.d/abstractions/common/chromium

@@ -24,12 +24,12 @@
 
         /tmp/ r,
         /var/tmp/ r,
-  owner /tmp/.org.chromium.Chromium.* rw,
-  owner /tmp/.org.chromium.Chromium.*/{,**} rw,
-  owner /tmp/scoped_dir*/ rw,
-  owner /tmp/scoped_dir*/SingletonCookie w,
-  owner /tmp/scoped_dir*/SingletonSocket w,
-  owner /tmp/scoped_dir*/SS w,
+  owner @{tmp}/.org.chromium.Chromium.* rw,
+  owner @{tmp}/.org.chromium.Chromium.*/{,**} rw,
+  owner @{tmp}/scoped_dir*/ rw,
+  owner @{tmp}/scoped_dir*/SingletonCookie w,
+  owner @{tmp}/scoped_dir*/SingletonSocket w,
+  owner @{tmp}/scoped_dir*/SS w,
 
         /dev/shm/ r,
   owner /dev/shm/.org.chromium.Chromium.* rw,

apparmor.d/abstractions/common/electron

@@ -50,14 +50,14 @@
   owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
   owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
 
-  owner /tmp/.org.chromium.Chromium.@{rand6} rw,
-  owner /tmp/.org.chromium.Chromium.@{rand6}/ rw,
-  owner /tmp/.org.chromium.Chromium.@{rand6}/SingletonCookie w,
-  owner /tmp/.org.chromium.Chromium.@{rand6}/SingletonSocket w,
-  owner /tmp/scoped_dir@{rand6}/ rw,
-  owner /tmp/scoped_dir@{rand6}/SingletonCookie w,
-  owner /tmp/scoped_dir@{rand6}/SingletonSocket w,
-  owner /tmp/scoped_dir@{rand6}/SS w,
+  owner @{tmp}/.org.chromium.Chromium.@{rand6} rw,
+  owner @{tmp}/.org.chromium.Chromium.@{rand6}/ rw,
+  owner @{tmp}/.org.chromium.Chromium.@{rand6}/SingletonCookie w,
+  owner @{tmp}/.org.chromium.Chromium.@{rand6}/SingletonSocket w,
+  owner @{tmp}/scoped_dir@{rand6}/ rw,
+  owner @{tmp}/scoped_dir@{rand6}/SingletonCookie w,
+  owner @{tmp}/scoped_dir@{rand6}/SingletonSocket w,
+  owner @{tmp}/scoped_dir@{rand6}/SS w,
 
   owner /dev/shm/.org.chromium.Chromium.@{rand6} rw,
 

apparmor.d/groups/_full/default

@@ -72,7 +72,7 @@ profile default @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   owner @{run}/user/@{uid}/{,**} rw,
   owner @{user_config_dirs}/** rwkl,
   owner @{user_share_dirs}/** rwkl,
-  owner /tmp/{,**} rwk,
+  owner @{tmp}/{,**} rwk,
 
   owner @{run}/user/@{uid}/{,**} rw,
 

apparmor.d/groups/akonadi/akonadi_mailfilter_agent

@@ -49,8 +49,8 @@ profile akonadi_mailfilter_agent @{exec_path} {
   owner @{user_config_dirs}/kmail2rc r,
   owner @{user_config_dirs}/kwinrc r,
   
-  owner /tmp/#@{int} rw,
-  owner /tmp/akonadi_mailfilter_agent.* rwl,
+  owner @{tmp}/#@{int} rw,
+  owner @{tmp}/akonadi_mailfilter_agent.* rwl,
 
   owner @{user_config_dirs}/specialmailcollectionsrc r,
 

apparmor.d/groups/apps/calibre

@@ -95,12 +95,10 @@ profile calibre @{exec_path} {
   owner @{user_cache_dirs}/gstreamer-@{int}/ rw,
   owner @{user_cache_dirs}/gstreamer-@{int}/registry.*.bin{,.tmp@{rand6}} rw,
 
-  owner /tmp/calibre_*_tmp_*/{,**} rw,
-  owner /tmp/calibre-*/{,**} rw,
-  owner /tmp/@{int}-*/ rw,
-  owner /tmp/@{int}-*/** rwl,
-#  owner /tmp/@{int}-*/** rwl -> /tmp/@{int}-*/**,  # newer AA version
-  owner /tmp/* rw,
+  owner @{tmp}/calibre_*_tmp_*/{,**} rw,
+  owner @{tmp}/calibre-*/{,**} rw,
+  owner @{tmp}/@{int}-*/ rw,
+  owner @{tmp}/@{int}-*/** rwl,
 
   owner /dev/shm/#@{int} rw,
 

apparmor.d/groups/apps/discord

@@ -34,9 +34,9 @@ profile discord @{exec_path} {
   /var/lib/dbus/machine-id r,
   /etc/machine-id r,
 
-  owner /tmp/net-export/ rw,
-  owner /tmp/discord.sock rw,
-  owner "/tmp/Discord Crashes/" rw,
+  owner @{tmp}/net-export/ rw,
+  owner @{tmp}/discord.sock rw,
+  owner "@{tmp}/Discord Crashes/" rw,
 
   owner @{run}/user/@{uid}/discord-ipc-@{int} rw,
 

apparmor.d/groups/apps/dropbox

@@ -60,11 +60,11 @@ profile dropbox @{exec_path} {
   @{bin}/{,@{multiarch}-}objdump    rix,
 
   # Needed for updating Dropbox
-  owner /tmp/.dropbox-dist-new-*/{,**} rw,
-  owner /tmp/.dropbox-dist-new-*/.dropbox-dist/dropboxd rix,
-  owner /tmp/.dropbox-dist-new-*/.dropbox-dist/dropbox-lnx.*/dropbox rwix,
-  owner /tmp/.dropbox-dist-new-*/.dropbox-dist/dropbox-lnx.*/dropboxd rwix,
-  owner /tmp/.dropbox-dist-new-*/.dropbox-dist/dropbox-lnx.*/*.so mrw,
+  owner @{tmp}/.dropbox-dist-new-*/{,**} rw,
+  owner @{tmp}/.dropbox-dist-new-*/.dropbox-dist/dropboxd rix,
+  owner @{tmp}/.dropbox-dist-new-*/.dropbox-dist/dropbox-lnx.*/dropbox rwix,
+  owner @{tmp}/.dropbox-dist-new-*/.dropbox-dist/dropbox-lnx.*/dropboxd rwix,
+  owner @{tmp}/.dropbox-dist-new-*/.dropbox-dist/dropbox-lnx.*/*.so mrw,
   owner @{HOME}/.dropbox-dist-old*/{,**} rw,
   owner @{HOME}/.dropbox-dist-tmp-*/{,**} rw,
 
@@ -105,9 +105,9 @@ profile dropbox @{exec_path} {
              @{PROC}/vmstat r,
 
   # Dropbox first tries the /tmp/ dir, and if it's denied it uses the /var/tmp/ dir instead
-  owner /tmp/dropbox-antifreeze-* rw,
-  owner /tmp/[a-zA-z0-9]* rw,
-  owner /tmp/#@{int} rw,
+  owner @{tmp}/dropbox-antifreeze-* rw,
+  owner @{tmp}/[a-zA-z0-9]* rw,
+  owner @{tmp}/#@{int} rw,
   owner /var/tmp/etilqs_@{hex} rw,
 
   @{run}/systemd/users/@{uid} r,

apparmor.d/groups/apps/filezilla

@@ -49,9 +49,9 @@ profile filezilla @{exec_path} {
 
   # Creating new files on FTP
         /tmp/ r,
-  owner /tmp/fz[0-9]temp-@{int}/ rw,
-  owner /tmp/fz[0-9]temp-@{int}/fz*-lockfile rwk,
-  owner /tmp/fz[0-9]temp-@{int}/empty_file_* rw,
+  owner @{tmp}/fz[0-9]temp-@{int}/ rw,
+  owner @{tmp}/fz[0-9]temp-@{int}/fz*-lockfile rwk,
+  owner @{tmp}/fz[0-9]temp-@{int}/empty_file_* rw,
 
   # External apps
   @{lib}/firefox/firefox rPUx,

apparmor.d/groups/apps/flameshot

@@ -50,9 +50,9 @@ profile flameshot @{exec_path} {
 
   /usr/share/hwdata/pnp.ids r,
 
-  owner /tmp/.*/{,s} rw,
-  owner /tmp/*= rw,
-  owner /tmp/qipc_{systemsem,sharedmemory}_*@{hex} rw,
+  owner @{tmp}/.*/{,s} rw,
+  owner @{tmp}/*= rw,
+  owner @{tmp}/qipc_{systemsem,sharedmemory}_*@{hex} rw,
 
   deny owner @{PROC}/@{pid}/cmdline r,
   deny       @{PROC}/sys/kernel/random/boot_id r,

apparmor.d/groups/apps/telegram-desktop

@@ -60,7 +60,7 @@ profile telegram-desktop @{exec_path} {
   # Autostart
   owner @{user_config_dirs}/autostart/telegramdesktop.desktop rw,
 
-  owner /tmp/@{hex}-* rwk,
+  owner @{tmp}/@{hex}-* rwk,
   owner @{run}/user/@{uid}/@{hex}-* rwk,
 
   /dev/shm/#@{int} rw,

apparmor.d/groups/apps/zathura

@@ -25,7 +25,7 @@ profile zathura @{exec_path} {
   owner @{user_config_dirs}/zathura/** r,
   owner @{user_share_dirs}/zathura/** rwk,
 
-  owner /tmp/gtkprint* rw,
+  owner @{tmp}/gtkprint* rw,
 
   include if exists <local/zathura>
 }

apparmor.d/groups/apt/apt

@@ -136,11 +136,11 @@ profile apt @{exec_path} flags=(attach_disconnected) {
         /tmp/ r,
         /tmp/apt-changelog-*/ w,
         /tmp/apt-changelog-*/*.changelog w,
-  owner /tmp/apt-changelog-*/.apt-acquire-privs-test.* rw,
-  owner /tmp/apt-dpkg-install-*/ rw,
-  owner /tmp/apt-dpkg-install-*/@{int}-*.deb w,
-  owner /tmp/apt.conf.* rw,
-  owner /tmp/apt.data.* rw,
+  owner @{tmp}/apt-changelog-*/.apt-acquire-privs-test.* rw,
+  owner @{tmp}/apt-dpkg-install-*/ rw,
+  owner @{tmp}/apt-dpkg-install-*/@{int}-*.deb w,
+  owner @{tmp}/apt.conf.* rw,
+  owner @{tmp}/apt.data.* rw,
 
         @{PROC}/@{pids}/cmdline r,
         @{PROC}/@{pids}/mountinfo r,
@@ -187,8 +187,8 @@ profile apt @{exec_path} flags=(attach_disconnected) {
 
     owner @{HOME}/.less* rw,
 
-    owner /tmp/apt-changelog-*/ r,
-    owner /tmp/apt-changelog-*/*.changelog r,
+    owner @{tmp}/apt-changelog-*/ r,
+    owner @{tmp}/apt-changelog-*/*.changelog r,
 
     include if exists <local/apt_pager>
   }

apparmor.d/groups/apt/apt-config

@@ -17,7 +17,7 @@ profile apt-config @{exec_path} {
 
   @{bin}/dpkg rPx -> child-dpkg,
 
-  owner /tmp/tmp*/apt.conf r,
+  owner @{tmp}/tmp*/apt.conf r,
 
   owner @{PROC}/@{pid}/fd/ r,
 

apparmor.d/groups/apt/apt-extracttemplates

@@ -27,7 +27,7 @@ profile apt-extracttemplates @{exec_path} {
 
   owner /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
 
-  owner /tmp/*.{config,template}.@{rand6} rw,
+  owner @{tmp}/*.{config,template}.@{rand6} rw,
   owner /var/cache/debconf/tmp.ci/*.{config,template}.@{rand6} rw,
 
   owner @{PROC}/@{pid}/fd/ r,

apparmor.d/groups/apt/apt-key

@@ -56,7 +56,7 @@ profile apt-key @{exec_path} {
   /etc/apt/trusted.gpg.d/{,*.gpg,*.asc} r,
 
         /tmp/ r,
-  owner /tmp/apt-key-gpghome.*/{,**} rw,
+  owner @{tmp}/apt-key-gpghome.*/{,**} rw,
 
 
   profile gpg {
@@ -93,9 +93,9 @@ profile apt-key @{exec_path} {
     /etc/apt/trusted.gpg.d/*.gpg r,
     /etc/apt/trusted.gpg.d/*.gpg.lock rwl -> /etc/apt/trusted.gpg.d/.#lk0x[a-f0-9]*.@{pid},
 
-    owner /tmp/apt-key-gpghome.*/ rw,
-    owner /tmp/apt-key-gpghome.*/** rwkl -> /tmp/apt-key-gpghome.*/**,
-    owner /tmp/apt-key-gpghome.*/gpgoutput.{log,err} w,
+    owner @{tmp}/apt-key-gpghome.*/ rw,
+    owner @{tmp}/apt-key-gpghome.*/** rwkl -> /tmp/apt-key-gpghome.*/**,
+    owner @{tmp}/apt-key-gpghome.*/gpgoutput.{log,err} w,
   
     owner @{run}/user/@{uid}/gnupg/d.*/ rw,
 

apparmor.d/groups/apt/apt-listbugs-migratepins

@@ -25,9 +25,9 @@ profile apt-listbugs-migratepins @{exec_path} {
 
   /etc/apt/preferences r,
 
-  owner /tmp/pin_migration_*-@{pid}-*/ w,
-  owner /tmp/pin_migration_*-@{pid}-*/preferences w,
-  owner /tmp/pin_migration_*-@{pid}-*/apt-listbugs w,
+  owner @{tmp}/pin_migration_*-@{pid}-*/ w,
+  owner @{tmp}/pin_migration_*-@{pid}-*/preferences w,
+  owner @{tmp}/pin_migration_*-@{pid}-*/apt-listbugs w,
 
   include if exists <local/apt-listbugs-migratepins>
 }

apparmor.d/groups/apt/apt-listchanges

@@ -53,16 +53,16 @@ profile apt-listchanges @{exec_path} {
   owner @{PROC}/@{pid}/fd/ r,
 
         /tmp/ r,
-  owner /tmp/* rw,
-  owner /tmp/apt-listchanges*/ rw,
-  owner /tmp/apt-listchanges*/**/ rw,
-  owner /tmp/apt-listchanges*/*/*/*/*/changelog.gz rw,
-  owner /tmp/apt-listchanges*/*/*/*/*/changelog.Debian*.gz rw,
-  owner /tmp/apt-listchanges*/*/*/*/*/NEWS.Debian.gz rw,
-  owner /tmp/apt-listchanges*/*/*/*/*/*/changelog.gz rw,
-  owner /tmp/apt-listchanges*/*/*/*/*/*/changelog/changelog_to_file rw,
-  owner /tmp/apt-listchanges*/*/*/*/*/*/changelog/simple_changelog rw,
-  owner /tmp/apt-listchanges*/*/*/*/*/*/*-local/debian/changelog rw,
+  owner @{tmp}/* rw,
+  owner @{tmp}/apt-listchanges*/ rw,
+  owner @{tmp}/apt-listchanges*/**/ rw,
+  owner @{tmp}/apt-listchanges*/*/*/*/*/changelog.gz rw,
+  owner @{tmp}/apt-listchanges*/*/*/*/*/changelog.Debian*.gz rw,
+  owner @{tmp}/apt-listchanges*/*/*/*/*/NEWS.Debian.gz rw,
+  owner @{tmp}/apt-listchanges*/*/*/*/*/*/changelog.gz rw,
+  owner @{tmp}/apt-listchanges*/*/*/*/*/*/changelog/changelog_to_file rw,
+  owner @{tmp}/apt-listchanges*/*/*/*/*/*/changelog/simple_changelog rw,
+  owner @{tmp}/apt-listchanges*/*/*/*/*/*/*-local/debian/changelog rw,
 
   # The following is needed when apt-listchanges uses debcconf GUI frontends.
   include <abstractions/gtk>
@@ -96,7 +96,7 @@ profile apt-listchanges @{exec_path} {
     /root/ r,
 
           /tmp/ r,
-    owner /tmp/apt-listchanges-tmp*.txt r,
+    owner @{tmp}/apt-listchanges-tmp*.txt r,
 
   }
 

apparmor.d/groups/apt/apt-methods-gpgv

@@ -81,9 +81,9 @@ profile apt-methods-gpgv @{exec_path} {
   @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
 
         /tmp/ r,
-  owner /tmp/apt-key-gpghome.*/ rw,
-  owner /tmp/apt-key-gpghome.*/** rwkl -> /tmp/apt-key-gpghome.*/**,
-  owner /tmp/apt.{conf,sig,data}.* rw,
+  owner @{tmp}/apt-key-gpghome.*/ rw,
+  owner @{tmp}/apt-key-gpghome.*/** rwkl -> /tmp/apt-key-gpghome.*/**,
+  owner @{tmp}/apt.{conf,sig,data}.* rw,
 
   @{PROC}/@{pid}/fd/ r,
 

apparmor.d/groups/apt/apt-methods-http

@@ -66,8 +66,8 @@ profile apt-methods-http @{exec_path} {
   @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
 
         /tmp/ r,
-  owner /tmp/aptitude-root.*/aptitude-download-* rw,
-  owner /tmp/apt-changelog-*/*.changelog rw,
+  owner @{tmp}/aptitude-root.*/aptitude-download-* rw,
+  owner @{tmp}/apt-changelog-*/*.changelog rw,
 
   @{run}/ubuntu-advantage/aptnews.json rw,
 

apparmor.d/groups/apt/apt-methods-store

@@ -53,7 +53,7 @@ profile apt-methods-store @{exec_path} {
   @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
 
         /tmp/ r,
-  owner /tmp/apt-changelog-*/*.changelog{,.*} rw,
+  owner @{tmp}/apt-changelog-*/*.changelog{,.*} rw,
 
   # file_inherit
   owner /dev/tty@{int} rw,

apparmor.d/groups/apt/aptitude

@@ -98,9 +98,9 @@ profile aptitude @{exec_path} flags=(complain) {
   @{bin}/apt rPx,
 
   # For changelogs
-  owner /tmp/aptitude-*.@{pid}:*/cache{ContentCompressed,Extracted}* rw,
-  owner /tmp/aptitude-*.@{pid}:*/aptitude-download-* rw,
-  owner /tmp/aptitude-*.@{pid}:*/parsedchangelog* w,
+  owner @{tmp}/aptitude-*.@{pid}:*/cache{ContentCompressed,Extracted}* rw,
+  owner @{tmp}/aptitude-*.@{pid}:*/aptitude-download-* rw,
+  owner @{tmp}/aptitude-*.@{pid}:*/parsedchangelog* w,
   owner @{user_cache_dirs}/ rw,
   owner @{user_cache_dirs}/aptitude/ rw,
   owner @{user_cache_dirs}/aptitude/metadata-download{,-journal} rw,
@@ -108,8 +108,8 @@ profile aptitude @{exec_path} flags=(complain) {
   @{bin}/sensible-pager rCx -> pager,
 
   # For aptitude-run-state-bundle
-  owner /tmp/aptitudebug.*/ r,
-  owner /tmp/aptitudebug.*/** rwk,
+  owner @{tmp}/aptitudebug.*/ r,
+  owner @{tmp}/aptitudebug.*/** rwk,
 
   /var/lib/apt-xapian-index/index r,
   /var/cache/apt-xapian-index/index.[0-9]/*.glass r,
@@ -121,11 +121,11 @@ profile aptitude @{exec_path} flags=(complain) {
   owner @{PROC}/@{pid}/fd/ r,
 
         /tmp/ r,
-  owner /tmp/aptitude-*.@{pid}:*/ rw,
-  owner /tmp/aptitude-*.@{pid}:*/{pkgstates,control}* rw,
         /tmp/aptitude-*.@{pid}:*/pkgstates* r,
-  owner /tmp/apt-dpkg-install-*/ rw,
-  owner /tmp/apt-dpkg-install-*/@{int}-*.deb w,
+  owner @{tmp}/aptitude-*.@{pid}:*/ rw,
+  owner @{tmp}/aptitude-*.@{pid}:*/{pkgstates,control}* rw,
+  owner @{tmp}/apt-dpkg-install-*/ rw,
+  owner @{tmp}/apt-dpkg-install-*/@{int}-*.deb w,
 
   /var/cache/apt/ r,
   /var/cache/apt/** rwk,
@@ -180,7 +180,7 @@ profile aptitude @{exec_path} flags=(complain) {
 
     owner @{HOME}/.less* rw,
 
-    owner /tmp/aptitude-*.@{pid}:*/aptitude-download-* rw,
+    owner @{tmp}/aptitude-*.@{pid}:*/aptitude-download-* rw,
 
     # For shell pwd
     /root/ r,

apparmor.d/groups/apt/aptitude-run-state-bundle

@@ -24,7 +24,7 @@ profile aptitude-run-state-bundle @{exec_path} {
 
   @{bin}/aptitude-curses rPx,
 
-  owner /tmp/aptitudebug.*/{,**} rw,
+  owner @{tmp}/aptitudebug.*/{,**} rw,
 
   include if exists <local/aptitude-run-state-bundle>
 }

apparmor.d/groups/apt/debsign

@@ -41,8 +41,8 @@ profile debsign @{exec_path} {
 
   owner @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
 
-  owner /tmp/debsign.*/ rw,
-  owner /tmp/debsign.*/*.{dsc,changes,buildinfo}{,.asc} rw,
+  owner @{tmp}/debsign.*/ rw,
+  owner @{tmp}/debsign.*/*.{dsc,changes,buildinfo}{,.asc} rw,
 
   profile gpg {
     include <abstractions/base>
@@ -52,8 +52,8 @@ profile debsign @{exec_path} {
     owner @{HOME}/@{XDG_GPG_DIR}/ r,
     owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
 
-    owner /tmp/debsign.*/*.{dsc,changes,buildinfo} r,
-    owner /tmp/debsign.*/*.{dsc,changes,buildinfo}.asc rw,
+    owner @{tmp}/debsign.*/*.{dsc,changes,buildinfo} r,
+    owner @{tmp}/debsign.*/*.{dsc,changes,buildinfo}.asc rw,
 
   }
 

apparmor.d/groups/apt/dpkg

@@ -67,7 +67,7 @@ profile dpkg @{exec_path} {
   /usr/** rwlk -> /usr/**,
   /var/** rwlk -> /var/**,
 
-  owner /tmp/apt-dpkg-install-*/ r,
+  owner @{tmp}/apt-dpkg-install-*/ r,
 
   @{run}/systemd/userdb/ r,
 

apparmor.d/groups/apt/dpkg-architecture

@@ -29,7 +29,7 @@ profile dpkg-architecture @{exec_path} {
   /etc/debian_version r,
 
   # file_inherit
-  owner /tmp/* rw,
+  owner @{tmp}/* rw,
 
 
   profile ccache {

apparmor.d/groups/apt/dpkg-deb

@@ -25,13 +25,13 @@ profile dpkg-deb @{exec_path} {
   owner /var/lib/dpkg/tmp.ci/* w,
 
   # For creating deb packages
-  owner /tmp/dpkg-deb.* rw,
+  owner @{tmp}/dpkg-deb.* rw,
 
-  owner /tmp/dpkg-deb.*/ rw,
-  owner /tmp/dpkg-deb.*/* rw,
+  owner @{tmp}/dpkg-deb.*/ rw,
+  owner @{tmp}/dpkg-deb.*/* rw,
 
   # For extracting deb packages to /tmp/
-  owner /tmp/** rw,
+  owner @{tmp}/** rw,
 
   /var/cache/apt/archives/*.deb r,
 

apparmor.d/groups/apt/dpkg-preconfigure

@@ -39,8 +39,8 @@ profile dpkg-preconfigure @{exec_path} {
   /etc/inputrc r,
   /etc/shadow r,
 
-  owner /tmp/*.template.* rw,
-  owner /tmp/*.config.* rwPUx,
+  owner @{tmp}/*.template.* rw,
+  owner @{tmp}/*.config.* rwPUx,
 
         /var/lib/dbus/machine-id r,
   owner /var/cache/debconf/ rw,

apparmor.d/groups/apt/reportbug

@@ -77,8 +77,8 @@ profile reportbug @{exec_path} {
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mounts r,
 
-  owner /tmp/* rw,
-  owner /tmp/reportbug-*-@{int}-@{pid}-* rw,
+  owner @{tmp}/* rw,
+  owner @{tmp}/reportbug-*-@{int}-@{pid}-* rw,
   owner /var/tmp/*.bug{,~} rw,
 
   @{sys}/module/apparmor/parameters/enabled r,
@@ -101,7 +101,7 @@ profile reportbug @{exec_path} {
     owner @{HOME}/@{XDG_GPG_DIR}/ rw,
     owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
 
-    owner /tmp/reportbug-*-{signed,unsigned}-* rw,
+    owner @{tmp}/reportbug-*-{signed,unsigned}-* rw,
     owner @{HOME}/draftbugreports/reportbug-*-{signed,unsigned}-* rw,
 
     include if exists <local/reportbug_gpg>

apparmor.d/groups/apt/synaptic

@@ -132,8 +132,8 @@ profile synaptic @{exec_path} {
   /etc/machine-id r,
 
         /tmp/ r,
-  owner /tmp/apt-dpkg-install-*/ rw,
-  owner /tmp/apt-dpkg-install-*/@{int}-*.deb w,
+  owner @{tmp}/apt-dpkg-install-*/ rw,
+  owner @{tmp}/apt-dpkg-install-*/@{int}-*.deb w,
 
   /var/cache/apt/ r,
   /var/cache/apt/** rwk,

apparmor.d/groups/apt/unattended-upgrade

@@ -103,7 +103,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
   owner @{run}/unattended-upgrades.pid rw,
   owner @{run}/unattended-upgrades.progress rw,
 
-  owner /tmp/apt-dpkg-install-*/{,*} rw,
+  owner @{tmp}/apt-dpkg-install-*/{,*} rw,
 
         @{PROC}/@{pids}/mountinfo r,
   owner @{PROC}/@{pids}/fd/ r,

apparmor.d/groups/browsers/brave

@@ -37,10 +37,10 @@ profile brave @{exec_path} {
   owner @{config_dirs}/WidevineCdm/libwidevinecdm.so mrw,
   owner @{cache_dirs}/BraveSoftware/ rw,
 
-  owner /tmp/net-export/ rw,  # For brave://net-export/
+  owner @{tmp}/net-export/ rw,  # For brave://net-export/
 
-  owner /tmp/.org.chromium.Chromium.* rwk,
-  owner /tmp/.org.chromium.Chromium*/{,**} rw,
+  owner @{tmp}/.org.chromium.Chromium.* rwk,
+  owner @{tmp}/.org.chromium.Chromium*/{,**} rw,
 
   owner /dev/shm/.org.chromium.Chromium.* rw,
 

apparmor.d/groups/browsers/chromium-wrapper

@@ -38,9 +38,9 @@ profile chromium-wrapper @{exec_path} {
 
   owner @{HOME}/.xsession-errors w,
 
-  owner /tmp/chromiumargs.@{rand6} rw,
-  owner /tmp/tmp.*/ rw,
-  owner /tmp/tmp.*/** rwk,
+  owner @{tmp}/chromiumargs.@{rand6} rw,
+  owner @{tmp}/tmp.*/ rw,
+  owner @{tmp}/tmp.*/** rwk,
 
   owner /dev/tty@{int} rw,
         /dev/dri/card[0-9] rw,

apparmor.d/groups/browsers/firefox

@@ -155,32 +155,27 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
 
         /tmp/ r,
         /var/tmp/ r,
-  owner /tmp/.xfsm-ICE-@{rand6} rw,
-  owner /tmp/@{name}/ rw,
-  owner /tmp/@{name}/* rwk,
-  owner /tmp/@{rand6}.tmp r,
-  owner /tmp/@{rand8}.txt w,
-  owner /tmp/* w,  # file downloads (to anywhere)
-  owner /tmp/firefox_*/ rw,
-  owner /tmp/firefox_*/* rwk,
-  owner /tmp/mozilla_*/ rw,
-  owner /tmp/mozilla_*/* rw,
-  owner /tmp/mozilla-temp-@{int} rw,
-  owner /tmp/Mozilla@{uuid}-cachePurge-??????????????? rwk,
-  owner /tmp/Mozilla\{@{uuid}\}-cachePurge-??????????????? rwk,
-  owner /tmp/MozillaBackgroundTask-???????????????-removeDirectory/.parentlock k,
-  owner /tmp/MozillaBackgroundTask-???????????????-removeDirectory/{**,} rw,
-  owner /tmp/Mozillato-be-removed-cachePurge-??????????????? rwk,
-  owner /tmp/Temp-@{uuid}/{**,} rw,
-  owner /tmp/tmp-???.xpi rw,
-  owner /tmp/tmpaddon r,
-  owner /tmp/tmpaddon-@{int} r,
-  owner /tmp/user/@{uid}/ rw,
-  owner /tmp/user/@{uid}/@{name}/ rw,
-  owner /tmp/user/@{uid}/@{name}/* rwk,
-  owner /tmp/user/@{uid}/* rwk,
-  owner /tmp/user/@{uid}/Temp-@{uuid}/ rw,
-  owner /tmp/user/@{uid}/Temp-@{uuid}/* rwk,
+  owner @{tmp}/.xfsm-ICE-@{rand6} rw,
+  owner @{tmp}/@{name}/ rw,
+  owner @{tmp}/@{name}/* rwk,
+  owner @{tmp}/@{rand6}.tmp r,
+  owner @{tmp}/@{rand8}.txt w,
+  owner @{tmp}/* w,  # file downloads (to anywhere)
+  owner @{tmp}/firefox_*/ rw,
+  owner @{tmp}/firefox_*/* rwk,
+  owner @{tmp}/mozilla_*/ rw,
+  owner @{tmp}/mozilla_*/* rw,
+  owner @{tmp}/mozilla-temp-@{int} rw,
+  owner @{tmp}/Mozilla@{uuid}-cachePurge-??????????????? rwk,
+  owner @{tmp}/Mozilla\{@{uuid}\}-cachePurge-??????????????? rwk,
+  owner @{tmp}/MozillaBackgroundTask-???????????????-removeDirectory/.parentlock k,
+  owner @{tmp}/MozillaBackgroundTask-???????????????-removeDirectory/{**,} rw,
+  owner @{tmp}/Mozillato-be-removed-cachePurge-??????????????? rwk,
+  owner @{tmp}/Temp-@{uuid}/ rw,
+  owner @{tmp}/Temp-@{uuid}/** rwk,
+  owner @{tmp}/tmp-???.xpi rw,
+  owner @{tmp}/tmpaddon r,
+  owner @{tmp}/tmpaddon-@{int} r,
 
   @{run}/mount/utab r,
 

apparmor.d/groups/browsers/firefox-crashreporter

@@ -46,8 +46,8 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) {
 
         /tmp/ r,
     /var/tmp/ r,
-  owner /tmp/@{hex}.{dmp,extra} rw,
-  owner /tmp/firefox/.parentlock w,
+  owner @{tmp}/@{hex}.{dmp,extra} rw,
+  owner @{tmp}/firefox/.parentlock w,
 
   owner /dev/shm/org.mozilla.ipc.@{int}.@{int} r,
 

apparmor.d/groups/browsers/firefox-glxtest

@@ -21,7 +21,7 @@ profile firefox-glxtest @{exec_path} flags=(attach_disconnected) {
 
   owner @{config_dirs}/firefox/*/.parentlock rw,
 
-  owner /tmp/@{name}/.parentlock rw,
+  owner @{tmp}/@{name}/.parentlock rw,
 
   owner @{PROC}/@{pid}/cmdline r,
 

apparmor.d/groups/browsers/firefox-minidump-analyzer

@@ -34,8 +34,8 @@ profile firefox-minidump-analyzer @{exec_path} {
 
   owner @{cache_dirs}/firefox/*.*/startupCache/*Cache* r,
 
-  owner /tmp/@{hex}.{dmp,extra} rw,
-  owner /tmp/firefox/.parentlock w,
+  owner @{tmp}/@{hex}.{dmp,extra} rw,
+  owner @{tmp}/firefox/.parentlock w,
 
   owner /dev/shm/org.mozilla.ipc.@{int}.@{int} r,
 

apparmor.d/groups/browsers/firefox-vaapitest

@@ -20,7 +20,7 @@ profile firefox-vaapitest @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
-  owner /tmp/@{name}/.parentlock rw,
+  owner @{tmp}/@{name}/.parentlock rw,
 
   deny @{config_dirs}/firefox/*/.parentlock rw,
   deny @{config_dirs}/firefox/*/startupCache/** r,

apparmor.d/groups/browsers/msedge

@@ -34,8 +34,8 @@ profile msedge @{exec_path} {
   owner @{user_cache_dirs}/Microsoft/ rw,
   owner @{user_cache_dirs}/Microsoft/** rwk,
 
-  owner /tmp/.ses rw,
-  owner /tmp/cv_debug.log rw,
+  owner @{tmp}/.ses rw,
+  owner @{tmp}/cv_debug.log rw,
 
   include if exists <local/msedge>
 }

apparmor.d/groups/cron/cron

@@ -55,7 +55,7 @@ profile cron @{exec_path} flags=(attach_disconnected) {
 
   @{run}/systemd/sessions/*.ref rw,
 
-  owner /tmp/#@{int} rw,
+  owner @{tmp}/#@{int} rw,
 
   owner @{PROC}/@{pid}/uid_map r,
   owner @{PROC}/@{pid}/loginuid rw,
@@ -71,7 +71,7 @@ profile cron @{exec_path} flags=(attach_disconnected) {
     /etc/cron.*/     r,
     /etc/cron.*/* rPUx,
 
-    owner /tmp/#@{int} rw,
+    owner @{tmp}/#@{int} rw,
 
    include if exists <local/cron_run_parts>
   }

apparmor.d/groups/cron/cron-apt

@@ -75,16 +75,16 @@ profile cron-apt @{exec_path} {
 
   # TMP
         /tmp/ r,
-  owner /tmp/cron-apt.*/ rw,
-  owner /tmp/cron-apt.*/difftemp rw,
-  owner /tmp/cron-apt.*/lockfile rw,
-  owner /tmp/cron-apt.*/initlog rw,
-  owner /tmp/cron-apt.*/status rw,
-  owner /tmp/cron-apt.*/run{log,error,mail,syslog} rw,
-  owner /tmp/cron-apt.*/action{log,error,mail,syslog} rw,
+  owner @{tmp}/cron-apt.*/ rw,
+  owner @{tmp}/cron-apt.*/difftemp rw,
+  owner @{tmp}/cron-apt.*/lockfile rw,
+  owner @{tmp}/cron-apt.*/initlog rw,
+  owner @{tmp}/cron-apt.*/status rw,
+  owner @{tmp}/cron-apt.*/run{log,error,mail,syslog} rw,
+  owner @{tmp}/cron-apt.*/action{log,error,mail,syslog} rw,
 
   # file_inherit
-  owner /tmp/#@{int} rw,
+  owner @{tmp}/#@{int} rw,
 
   include if exists <local/cron-apt>
 }

apparmor.d/groups/cron/cron-popularity-contest

@@ -54,11 +54,11 @@ profile cron-popularity-contest @{exec_path} {
   /var/lib/popularity-contest/ rw,
   /var/lib/popularity-contest/lastsub rw,
 
-  owner /tmp/tmp.*/ rw,
-  owner /tmp/tmp.*/random_seed w,
+  owner @{tmp}/tmp.*/ rw,
+  owner @{tmp}/tmp.*/random_seed w,
 
   # file_inherit
-  owner /tmp/#@{int} rw,
+  owner @{tmp}/#@{int} rw,
 
 
   profile savelog {
@@ -83,7 +83,7 @@ profile cron-popularity-contest @{exec_path} {
     /var/log/popularity-contest rw,
 
     # file_inherit
-    owner /tmp/#@{int} rw,
+    owner @{tmp}/#@{int} rw,
 
   }
 
@@ -107,7 +107,7 @@ profile cron-popularity-contest @{exec_path} {
     /var/log/popularity-contest.new w,
 
     # file_inherit
-    owner /tmp/#@{int} rw,
+    owner @{tmp}/#@{int} rw,
 
   }
 
@@ -124,10 +124,10 @@ profile cron-popularity-contest @{exec_path} {
     /var/log/popularity-contest.@{int} r,
     /var/log/popularity-contest.@{int}.gpg rw,
 
-    owner /tmp/tmp.*/** rwkl -> /tmp/tmp.*/**,
+    owner @{tmp}/tmp.*/** rwkl -> /tmp/tmp.*/**,
 
     # file_inherit
-    owner /tmp/#@{int} rw,
+    owner @{tmp}/#@{int} rw,
 
   }
 
@@ -152,7 +152,7 @@ profile cron-popularity-contest @{exec_path} {
     /var/log/popularity-contest.@{int}.gpg r,
 
     # file_inherit
-    owner /tmp/#@{int} rw,
+    owner @{tmp}/#@{int} rw,
 
   }
 

apparmor.d/groups/cron/crontab

@@ -30,7 +30,7 @@ profile crontab @{exec_path} {
         /var/spool/cron/crontabs/ rw,
   owner /var/spool/cron/crontabs/* rw,
 
-  owner /tmp/crontab.*/{,crontab} rw,
+  owner @{tmp}/crontab.*/{,crontab} rw,
 
 
   profile editor {
@@ -51,7 +51,7 @@ profile crontab @{exec_path} {
     owner @{HOME}/.viminfo{,.tmp} rw,
 
           /tmp/ r,
-    owner /tmp/crontab.*/crontab rw,
+    owner @{tmp}/crontab.*/crontab rw,
 
     # file_inherit
     /etc/cron.{allow,deny} r,

apparmor.d/groups/display-manager/x11-xsession

@@ -65,9 +65,8 @@ profile x11-xsession @{exec_path} {
 
   owner @{HOME}/.xsession-errors w,
 
-  owner /tmp/file* rw,
-  owner /tmp/tmp.@{rand10} rw,
-  owner /tmp/user/@{uid}/tmp.@{rand10} rw,
+  owner @{tmp}/file* rw,
+  owner @{tmp}/tmp.@{rand10} rw,
 
   profile ssh-agent {
     include <abstractions/base>
@@ -88,8 +87,8 @@ profile x11-xsession @{exec_path} {
 
     owner @{HOME}/.xsession-errors w,
 
-    owner /tmp/ssh-*/ rw,
-    owner /tmp/ssh-*/agent.* rw,
+    owner @{tmp}/ssh-*/ rw,
+    owner @{tmp}/ssh-*/agent.* rw,
 
     include if exists <local/x11-xsession_ssh-agent>
   }

apparmor.d/groups/display-manager/xdm-xsession

@@ -75,8 +75,8 @@ profile xdm-xsession @{exec_path} {
 
   @{run}/user/@{uid}/xauth_@{rand6} rl,
 
-  owner /tmp/ssh-*/ rw,
-  owner /tmp/ssh-*/agent.* rw,
+  owner @{tmp}/ssh-*/ rw,
+  owner @{tmp}/ssh-*/agent.* rw,
 
         @{PROC}/@{pids}/stat r,
         @{PROC}/@{pids}/statm r,

apparmor.d/groups/freedesktop/accounts-daemon

@@ -75,7 +75,7 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) {
   # wtmp.d ?
   /var/log/wtmp r,
 
-  owner /tmp/gnome-control-center-user-icon-@{rand6} rw,
+  owner @{tmp}/gnome-control-center-user-icon-@{rand6} rw,
 
   include if exists <local/accounts-daemon>
 }

apparmor.d/groups/freedesktop/pipewire

@@ -49,7 +49,7 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
 
   owner @{user_config_dirs}/pipewire/{,**} r,
 
-  owner /tmp/librnnoise-@{int}.so rm,
+  owner @{tmp}/librnnoise-@{int}.so rm,
 
   owner @{run}/user/@{uid}/pipewire-@{int} rw,
   owner @{run}/user/@{uid}/pipewire-@{int}-manager.lock rwk,

apparmor.d/groups/freedesktop/pipewire-pulse

@@ -32,7 +32,7 @@ profile pipewire-pulse @{exec_path} flags=(attach_disconnected) {
   /.flatpak-info r,
 
   owner @{run}/user/@{uid}/pulse/pid w,
-  owner /tmp/librnnoise-@{int}.so rm,
+  owner @{tmp}/librnnoise-@{int}.so rm,
 
   @{sys}/devices/virtual/dmi/id/product_name r,
   @{sys}/devices/virtual/dmi/id/sys_vendor r,

apparmor.d/groups/freedesktop/polkit-kde-authentication-agent

@@ -37,8 +37,8 @@ profile polkit-kde-authentication-agent @{exec_path} flags=(attach_disconnected)
 
   owner @{user_cache_dirs}/icon-cache.kcache rw,
 
-  owner /tmp/#@{int} rw,
-  owner /tmp/polkit-kde-authentication-agent-[0-9].* rwl -> /tmp/#@{int},
+  owner @{tmp}/#@{int} rw,
+  owner @{tmp}/polkit-kde-authentication-agent-[0-9].* rwl -> /tmp/#@{int},
   # owner /tmp/xauth_@{rand6} r,
 
   /dev/shm/#@{int} rw,

apparmor.d/groups/freedesktop/xdg-desktop-portal

@@ -83,7 +83,7 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
 
   @{user_config_dirs}/kioslaverc r,
 
-  owner /tmp/icon* rw,
+  owner @{tmp}/icon* rw,
 
   owner @{run}/user/@{uid}/.flatpak/{,*/*} r,
   owner @{run}/user/@{uid}/pipewire-@{int} rw,

apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome

@@ -72,8 +72,8 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) {
 
   owner @{HOME}/*/{,**} rw,
 
-  owner /tmp/.goutputstream-@{rand6} rw,
-  owner /tmp/@{rand6} rw,
+  owner @{tmp}/.goutputstream-@{rand6} rw,
+  owner @{tmp}/@{rand6} rw,
 
   @{run}/mount/utab r,
 

apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk

@@ -62,7 +62,7 @@ profile xdg-desktop-portal-gtk @{exec_path} {
   owner @{HOME}/.icons/{,**} r,
   owner @{HOME}/@{XDG_DATA_DIR}/ r,
 
-  owner /tmp/runtime-*/xauth_@{rand6} r,
+  owner @{tmp}/runtime-*/xauth_@{rand6} r,
 
         @{run}/mount/utab r,
         @{run}/user/@{uid}/xauth_@{rand6} rl,

apparmor.d/groups/freedesktop/xdg-icon-resource

@@ -33,7 +33,7 @@ profile xdg-icon-resource @{exec_path} flags=(attach_disconnected) {
   /usr/share/icons/*/.xdg-icon-resource-dummy rw,
   /usr/share/terminfo/** r,
 
-  owner /tmp/.com.google.Chrome.*/chrome-*.png r,
+  owner @{tmp}/.com.google.Chrome.*/chrome-*.png r,
 
   owner @{user_share_dirs}/icons/**/apps/chrome-*.png rw,
   owner @{user_share_dirs}/icons/**/.xdg-icon-resource-dummy rw,

apparmor.d/groups/freedesktop/xdg-screensaver

@@ -36,7 +36,7 @@ profile xdg-screensaver @{exec_path} {
 
   owner @{HOME}/ r,
   owner @{HOME}/.Xauthority r,
-  owner /tmp/xauth-@{int}-_[0-9] r,
+  owner @{tmp}/xauth-@{int}-_[0-9] r,
 
   owner @{run}/user/@{uid}/ r,
 

apparmor.d/groups/freedesktop/xkbcomp

@@ -31,7 +31,7 @@ profile xkbcomp @{exec_path} flags=(attach_disconnected) {
 
   owner @{run}/user/@{uid}/server-@{int}.xkm rwk,
 
-  owner /tmp/server-@{int}.xkm rwk,
+  owner @{tmp}/server-@{int}.xkm rwk,
 
   /dev/dri/card@{int} rw,
   /dev/fb@{int} rw,

apparmor.d/groups/freedesktop/xorg

@@ -83,10 +83,10 @@ profile xorg @{exec_path} flags=(attach_disconnected) {
 
         /tmp/ r,
         /tmp/server-@{int}.xkm rw,
-  owner /tmp/.tX@{int}-lock rwk,
-  owner /tmp/.X@{int}-lock rwkl -> /tmp/.tX@{int}-lock,
-  owner /tmp/server-* rwk,
-  owner /tmp/serverauth.* r,
+  owner @{tmp}/.tX@{int}-lock rwk,
+  owner @{tmp}/.X@{int}-lock rwkl -> /tmp/.tX@{int}-lock,
+  owner @{tmp}/server-* rwk,
+  owner @{tmp}/serverauth.* r,
 
   @{sys}/bus/ r,
   @{sys}/bus/pci/devices/ r,

apparmor.d/groups/freedesktop/xrdb

@@ -37,12 +37,12 @@ profile xrdb @{exec_path} {
 
   owner @{user_share_dirs}/sddm/wayland-session.log w,
 
-  owner /tmp/kcminit.* r,
-  owner /tmp/kded{5,6}.@{rand6} r,
-  owner /tmp/plasma-apply-lookandfeel.* r,
-  owner /tmp/runtime-*/xauth_@{rand6} r,
-  owner /tmp/startplasma-x11.@{rand6} r,
-  owner /tmp/xauth-@{int}-_[0-9] r,
+  owner @{tmp}/kcminit.* r,
+  owner @{tmp}/kded{5,6}.@{rand6} r,
+  owner @{tmp}/plasma-apply-lookandfeel.* r,
+  owner @{tmp}/runtime-*/xauth_@{rand6} r,
+  owner @{tmp}/startplasma-x11.@{rand6} r,
+  owner @{tmp}/xauth-@{int}-_[0-9] r,
 
   @{run}/sddm/\{@{uuid}\} r,
   @{run}/sddm/xauth_@{rand6} r,

apparmor.d/groups/freedesktop/xsetroot

@@ -29,7 +29,7 @@ profile xsetroot @{exec_path} {
   owner @{user_share_dirs}/sddm/xorg-session.log w,
   owner @{user_share_dirs}/sddm/wayland-session.log w,
 
-  owner /tmp/xauth_@{rand6} r,
+  owner @{tmp}/xauth_@{rand6} r,
 
   @{run}/sddm/\{@{uuid}\} r,
   @{run}/user/@{uid}/xauth_@{rand6} rl,

apparmor.d/groups/freedesktop/xwayland

@@ -26,7 +26,7 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
   /usr/share/fonts/{,**} r,
   /usr/share/ghostscript/fonts/{,**} r,
 
-  owner /tmp/server-@{int}.xkm rwk,
+  owner @{tmp}/server-@{int}.xkm rwk,
   owner @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} rw,
   owner @{run}/user/@{uid}/server-@{int}.xkm rw,
   owner @{run}/user/@{uid}/xwayland-shared-@{rand6} rw,

apparmor.d/groups/gnome/epiphany-search-provider

@@ -31,8 +31,8 @@ profile epiphany-search-provider @{exec_path} {
   owner @{user_cache_dirs}/epiphany/{,**} rwk,
   owner @{user_share_dirs}/epiphany/{,**} rwk,
 
-  owner /tmp/ContentRuleList@{rand6} rw,
-  owner /tmp/Serialized* rw,
+  owner @{tmp}/ContentRuleList@{rand6} rw,
+  owner @{tmp}/Serialized* rw,
 
         @{sys}/devices/virtual/dmi/id/chassis_type r,
         @{sys}/firmware/acpi/pm_profile r,

apparmor.d/groups/gnome/gdm-xsession

@@ -59,7 +59,7 @@ profile gdm-xsession @{exec_path} {
   /etc/default/im-config r,
   /etc/X11/{,**} r,
 
-  owner /tmp/gdm{3,}-config-err-@{rand6} rw,
+  owner @{tmp}/gdm{3,}-config-err-@{rand6} rw,
 
   /dev/tty@{int} rw,
 

apparmor.d/groups/gnome/gio-launch-desktop

@@ -26,7 +26,7 @@ profile gio-launch-desktop @{exec_path} flags=(attach_disconnected) {
 
   owner @{HOME}/{,**} rw,
 
-  owner /tmp/wl-copy-buffer-@{rand6}/stdin r,
+  owner @{tmp}/wl-copy-buffer-@{rand6}/stdin r,
 
   @{run}/mount/utab r,
 

apparmor.d/groups/gnome/gnome-control-center

@@ -127,7 +127,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
   owner @{user_share_dirs}/gnome-remote-desktop/rdp-tls.{crt,key}{,.@{rand6}} rw,
   owner @{user_share_dirs}/icc/{,edid-*} r,
 
-  owner /tmp/gdkpixbuf-xpm-tmp.@{rand6} rw,
+  owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw,
 
         @{run}/cups/cups.sock rw,
         @{run}/samba/ rw,

apparmor.d/groups/gnome/gnome-desktop-thumbnailers

@@ -22,10 +22,10 @@ profile gnome-desktop-thumbnailers flags=(attach_disconnected) {
 
   owner @{user_cache_dirs}/gnome-desktop-thumbnailer/{,**} rw,
 
-  owner /tmp/flatpak-seccomp-@{rand6} rw,
-  owner /tmp/gnome-desktop-file-to-thumbnail.* r,
-  owner /tmp/gnome-desktop-thumbnailer.png w,
-  owner /tmp/gsf-thumbnailer-@{rand6} rw,
+  owner @{tmp}/flatpak-seccomp-@{rand6} rw,
+  owner @{tmp}/gnome-desktop-file-to-thumbnail.* r,
+  owner @{tmp}/gnome-desktop-thumbnailer.png w,
+  owner @{tmp}/gsf-thumbnailer-@{rand6} rw,
 
   include if exists <local/gnome-desktop-thumbnailers>
 }

apparmor.d/groups/gnome/gnome-disk-image-mounter

@@ -18,7 +18,7 @@ profile gnome-disk-image-mounter @{exec_path} {
   # Allow to mount user files
   owner @{HOME}/{,**} r,
   owner @{MOUNTS}/{,**} r,
-  owner /tmp/*/{,**} r,
+  owner @{tmp}/*/{,**} r,
 
   @{run}/mount/utab r,
 

apparmor.d/groups/gnome/gnome-music

@@ -47,7 +47,7 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) {
 
   @{run}/systemd/inhibit/[0-9]*.ref rw,
 
-  owner /tmp/grilo-plugin-cache-[0-9A-Z]*/ rw,
+  owner @{tmp}/grilo-plugin-cache-[0-9A-Z]*/ rw,
   owner /var/tmp/etilqs_@{hex} rw,
 
         @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,

apparmor.d/groups/gnome/gnome-shell

@@ -285,8 +285,8 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
 
         /tmp/.X@{int}-lock rw,
         /tmp/dbus-@{rand8} rw,
-  owner /tmp/@{rand6}.shell-extension.zip rw,
-  owner /tmp/gdkpixbuf-xpm-tmp.@{rand6} rw,
+  owner @{tmp}/@{rand6}.shell-extension.zip rw,
+  owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw,
 
   @{run}/systemd/users/@{uid} r,
   @{run}/systemd/seats/seat@{int} r,

apparmor.d/groups/gnome/gnome-software

@@ -86,9 +86,9 @@ profile gnome-software @{exec_path} {
   owner @{user_share_dirs}/flatpak/repo/** rwl -> @{user_share_dirs}/flatpak/repo/**,
   owner @{user_share_dirs}/gnome-software/{,**} rw,
 
-  owner /tmp/ostree-gpg-*/ rw,
-  owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
-  owner /tmp/#@{int} rw,
+  owner @{tmp}/ostree-gpg-*/ rw,
+  owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
+  owner @{tmp}/#@{int} rw,
 
   owner @{run}/user/@{uid}/.dbus-proxy/ rw,
   owner @{run}/user/@{uid}/.dbus-proxy/a11y-bus-proxy-@{rand6} rw,
@@ -121,8 +121,8 @@ profile gnome-software @{exec_path} {
 
     @{HOME}/@{XDG_GPG_DIR}/*.conf r,
 
-    owner /tmp/ostree-gpg-*/ r,
-    owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
+    owner @{tmp}/ostree-gpg-*/ r,
+    owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
 
     owner @{run}/user/@{uid}/gnupg/ w,
 

apparmor.d/groups/gnome/gnome-terminal-server

@@ -56,7 +56,7 @@ profile gnome-terminal-server @{exec_path} {
   owner @{user_config_dirs}/ibus/bus/ r,
   owner @{user_config_dirs}/ibus/bus/@{hex32}-unix-{,wayland-}@{int} r,
 
-  owner /tmp/#@{int} rw,
+  owner @{tmp}/#@{int} rw,
 
   @{PROC}/@{pids}/cmdline r,
   @{PROC}/@{pids}/cgroup r,

apparmor.d/groups/gnome/kgx

@@ -32,7 +32,7 @@ profile kgx @{exec_path} {
 
   @{open_path}                rPx -> child-open-help,
 
-  owner /tmp/#@{int} rw,
+  owner @{tmp}/#@{int} rw,
 
         @{PROC}/ r,
         @{PROC}/@{pids}/cmdline r,

apparmor.d/groups/gnome/nautilus

@@ -92,7 +92,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
   @{MOUNTS}/** rw,
   owner @{HOME}/{,**} rw,
   owner @{run}/user/@{uid}/{,**} rw,
-  owner /tmp/{,**} rw,
+  owner @{tmp}/{,**} rw,
 
   # Silence non user's data
   deny /boot/{,**} r,

apparmor.d/groups/gnome/tracker-extract

@@ -63,13 +63,13 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) {
   # Allow to search user files
   owner @{HOME}/{,**} r,
   owner @{MOUNTS}/{,**} r,
-  owner /tmp/*/{,**} r,
+  owner @{tmp}/*/{,**} r,
 
   owner @{user_cache_dirs}/tracker3/ w,
   owner @{user_cache_dirs}/tracker3/files/{,**} rwk,
   owner @{user_share_dirs}/gvfs-metadata/** r,
 
-  owner /tmp/tracker-extract-3-files.*/{,*} rw,
+  owner @{tmp}/tracker-extract-3-files.*/{,*} rw,
 
   @{run}/blkid/blkid.tab r,
 

apparmor.d/groups/gnome/tracker-miner

@@ -70,7 +70,7 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
   # Allow to search user files
   owner @{HOME}/{,**} r,
   owner @{MOUNTS}/{,**} r,
-  owner /tmp/*/{,**} r,
+  owner @{tmp}/*/{,**} r,
 
   owner @{user_cache_dirs}/tracker3/ rw,
   owner @{user_cache_dirs}/tracker3/files/{,**} rwk,

apparmor.d/groups/gpg/gpg

@@ -55,10 +55,10 @@ profile gpg @{exec_path} {
   owner /var/tmp/zypp.@{rand6}/** rwkl -> /var/tmp/zypp.@{rand6}/**,
 
   #aa:exclude ubuntu
-  owner /tmp/ostree-gpg-*/ r,
-  owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
+  owner @{tmp}/ostree-gpg-*/ r,
+  owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
 
-  owner /tmp/tmp.[a-zA-Z0-9]* rw,
+  owner @{tmp}/tmp.[a-zA-Z0-9]* rw,
 
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,

apparmor.d/groups/gpg/gpg-agent

@@ -75,11 +75,11 @@ profile gpg-agent @{exec_path} {
   owner /var/tmp/zypp.*/{,*/}private-keys-v1.d/@{hex}.key rw,
   owner /var/tmp/zypp.*/{,*/}S.gpg-agent{,.ssh,.browser,.extra} rw,
 
-  owner /tmp/tmp.*/gnupg/ rw,
-  owner /tmp/tmp.*/gnupg/private-keys-v1.d/ rw,
-  owner /tmp/tmp.*/gnupg/private-keys-v1.d/@{hex}.key rw,
-  owner /tmp/tmp.*/gnupg/{,d.*/}S.gpg-agent rw,
-  owner /tmp/tmp.*/gnupg/sshcontrol r,
+  owner @{tmp}/tmp.*/gnupg/ rw,
+  owner @{tmp}/tmp.*/gnupg/private-keys-v1.d/ rw,
+  owner @{tmp}/tmp.*/gnupg/private-keys-v1.d/@{hex}.key rw,
+  owner @{tmp}/tmp.*/gnupg/{,d.*/}S.gpg-agent rw,
+  owner @{tmp}/tmp.*/gnupg/sshcontrol r,
 
   @{PROC}/@{pid}/fd/ r,
 

apparmor.d/groups/gpg/gpg-connect-agent

@@ -22,9 +22,9 @@ profile gpg-connect-agent @{exec_path} {
 
   owner @{run}/user/@{uid}/gnupg/d.*/ rw,
 
-  owner /tmp/tmp.*/.#lk0x@{hex}.*.@{pid} rw,
-  owner /tmp/tmp.*/.#lk0x@{hex}.*.@{pid}x rwl -> /tmp/*/.#lk0x@{hex}.*.@{pid},
-  owner /tmp/tmp.*/gnupg_spawn_agent_sentinel.lock rwl -> /tmp/*/.#lk0x@{hex}.*.@{pid},
+  owner @{tmp}/tmp.*/.#lk0x@{hex}.*.@{pid} rw,
+  owner @{tmp}/tmp.*/.#lk0x@{hex}.*.@{pid}x rwl -> /tmp/*/.#lk0x@{hex}.*.@{pid},
+  owner @{tmp}/tmp.*/gnupg_spawn_agent_sentinel.lock rwl -> /tmp/*/.#lk0x@{hex}.*.@{pid},
 
   include if exists <local/gpg-connect-agent>
 }

apparmor.d/groups/grub/grub-check-signatures

@@ -22,7 +22,7 @@ profile grub-check-signatures @{exec_path} {
 
   /usr/share/debconf/confmodule r,
 
-  owner /tmp/tmp.*/ rw,
+  owner @{tmp}/tmp.*/ rw,
 
   include if exists <local/grub-check-signatures>
 }

apparmor.d/groups/kde/baloo

@@ -33,7 +33,7 @@ profile baloo @{exec_path} {
   # Allow to search user files
   owner @{HOME}/{,**} r,
   owner @{MOUNTS}/{,**} r,
-  owner /tmp/*/{,**} r,
+  owner @{tmp}/*/{,**} r,
 
   owner @{user_config_dirs}/#@{int} rw,
   owner @{user_config_dirs}/baloofilerc rwl,

apparmor.d/groups/kde/dolphin

@@ -54,7 +54,7 @@ profile dolphin @{exec_path} {
   @{MOUNTS}/** rw,
   owner @{HOME}/{,**} rw,
   owner @{run}/user/@{uid}/{,**} rw,
-  owner /tmp/{,**} rw,
+  owner @{tmp}/{,**} rw,
 
   # Silence non user's data
   deny /boot/{,**} r,

apparmor.d/groups/kde/kcminit

@@ -32,11 +32,11 @@ profile kcminit @{exec_path} {
   owner @{user_config_dirs}/Trolltech.conf.lock rwk,
   owner @{user_config_dirs}/Trolltech.conf{,.@{rand6}} rwl,
 
-  owner /tmp/#@{int} rw,
-  owner /tmp/kcminit.@{rand6} rwl,
+  owner @{tmp}/#@{int} rw,
+  owner @{tmp}/kcminit.@{rand6} rwl,
 
-  owner /tmp/.touchpaddefaults wl,
-  owner /tmp/.touchpaddefaults.lock rwk,
+  owner @{tmp}/.touchpaddefaults wl,
+  owner @{tmp}/.touchpaddefaults.lock rwk,
 
   @{run}/user/@{uid}/xauth_@{rand6} rl,
 

apparmor.d/groups/kde/kconf_update

@@ -91,9 +91,9 @@ profile kconf_update @{exec_path} {
   owner @{user_share_dirs}/krunnerstaterc.lock rwk,
   owner @{user_share_dirs}/krunnerstaterc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int},
 
-  owner /tmp/#@{int} rw,
-  owner /tmp/kconf_update.@{rand6}.lock rwk,
-  owner /tmp/kconf_update.@{rand6}{,.@{rand6}} rwl -> /tmp/#@{int},
+  owner @{tmp}/#@{int} rw,
+  owner @{tmp}/kconf_update.@{rand6}.lock rwk,
+  owner @{tmp}/kconf_update.@{rand6}{,.@{rand6}} rwl -> /tmp/#@{int},
 
   @{sys}/devices/system/node/ r,
   @{sys}/devices/system/node/node@{int}/meminfo r,

apparmor.d/groups/kde/kded

@@ -156,9 +156,9 @@ profile kded @{exec_path} {
   owner @{run}/user/@{uid}/#@{int} rw,
   owner @{run}/user/@{uid}/kded{5,6}*kioworker.socket rwl,
 
-  owner /tmp/#@{int} rw,
-  owner /tmp/kded6.@{rand6} rwl -> /tmp/#@{int},
-  owner /tmp/plasma-csd-generator.@{rand6}/{,**} rw,
+  owner @{tmp}/#@{int} rw,
+  owner @{tmp}/kded6.@{rand6} rwl -> /tmp/#@{int},
+  owner @{tmp}/plasma-csd-generator.@{rand6}/{,**} rw,
 
         @{PROC}/ r,
         @{PROC}/@{pids}/cmdline/ r,

apparmor.d/groups/kde/kioworker

@@ -60,7 +60,7 @@ profile kioworker @{exec_path} {
   @{MOUNTS}/** rw,
   owner @{HOME}/{,**} rw,
   owner @{run}/user/@{uid}/{,**} rw,
-  owner /tmp/{,**} rw,
+  owner @{tmp}/{,**} rw,
 
   # Silence non user's data
   deny /boot/{,**} r,
@@ -86,7 +86,7 @@ profile kioworker @{exec_path} {
   owner @{user_share_dirs}/kactivitymanagerd/resources/database-wal rw,
   owner @{user_share_dirs}/kservices{5,6}/{,**} r,
 
-  owner /tmp/#@{int} rw,
+  owner @{tmp}/#@{int} rw,
 
         @{run}/mount/utab r,
   owner @{run}/user/@{uid}/#@{int} rw,

apparmor.d/groups/kde/konsole

@@ -59,8 +59,8 @@ profile konsole @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   owner @{user_share_dirs}/konsole/** rwlk,
   owner @{user_share_dirs}/kxmlgui5/konsole/{,**} r,
 
-  owner /tmp/#@{int} rw,
-  owner /tmp/konsole.@{rand6} rw,
+  owner @{tmp}/#@{int} rw,
+  owner @{tmp}/konsole.@{rand6} rw,
 
   @{PROC}/sys/kernel/core_pattern r,
   @{PROC}/@{pid}/cmdline r,

apparmor.d/groups/kde/kscreenlocker_greet

@@ -91,7 +91,7 @@ profile kscreenlocker_greet @{exec_path} {
   deny owner @{HOME}/#@{int} mrw,
        owner @{HOME}/.glvnd* mrw,
 
-  owner /tmp/*-cover-*.{jpg,png} r,
+  owner @{tmp}/*-cover-*.{jpg,png} r,
 
   @{run}/faillock/[a-zA-z0-9]* rwk,
 

apparmor.d/groups/kde/ksmserver

@@ -62,7 +62,7 @@ profile ksmserver @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   owner @{user_share_dirs}/kservices{5,6}/ r,
   owner @{user_share_dirs}/kservices{5,6}/ServiceMenus/ r,
 
-  owner /tmp/@{rand6} rw,
+  owner @{tmp}/@{rand6} rw,
 
         @{run}/systemd/inhibit/[0-9]*.ref rw,
   owner @{run}/user/@{uid}/KSMserver__[0-9] rw,

apparmor.d/groups/kde/kwalletd

@@ -41,7 +41,7 @@ profile kwalletd @{exec_path} {
   owner @{user_share_dirs}/kwalletd/ rw,
   owner @{user_share_dirs}/kwalletd/** rwkl -> @{user_share_dirs}/kwalletd/#@{int},
 
-  owner /tmp/kwalletd5.* rw,
+  owner @{tmp}/kwalletd5.* rw,
 
         @{PROC}/sys/kernel/core_pattern r,
   owner @{PROC}/@{pid}/cmdline r,

apparmor.d/groups/kde/kwin_x11

@@ -56,8 +56,8 @@ profile kwin_x11 @{exec_path} {
   owner @{user_config_dirs}/session/kwin_* rwk,
   owner @{user_config_dirs}/plasmarc r,
   owner @{user_config_dirs}/session/#@{int} rw,
-  owner /tmp/#@{int} rw,
-  owner /tmp/kwin.@{rand6} rwl,
+  owner @{tmp}/#@{int} rw,
+  owner @{tmp}/kwin.@{rand6} rwl,
 
   owner @{run}/user/@{uid}/kcrash_@{int} rw,
 

apparmor.d/groups/kde/okular

@@ -45,8 +45,8 @@ profile okular @{exec_path} {
 
   owner @{user_cache_dirs}/okular/{,**} rw,
 
-  owner /tmp/#@{int} rw,
-  owner /tmp/okular_@{rand6}.ps rwl -> /tmp/#@{int},
+  owner @{tmp}/#@{int} rw,
+  owner @{tmp}/okular_@{rand6}.ps rwl -> /tmp/#@{int},
 
   @{PROC}/sys/kernel/core_pattern r,
 

apparmor.d/groups/kde/plasma-discover

@@ -83,11 +83,11 @@ profile plasma-discover @{exec_path} {
   owner @{user_share_dirs}/kwin/ rw,
   owner @{user_share_dirs}/kwin/** rwlk -> @{user_share_dirs}/kwin/**,
 
-  owner /tmp/*.kwinscript rwl -> /tmp/#@{int},
-  owner /tmp/#@{int} rw,
-  owner /tmp/discover-@{rand6}/{,**} rw,
-  owner /tmp/ostree-gpg-*/ rw,
-  owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
+  owner @{tmp}/*.kwinscript rwl -> /tmp/#@{int},
+  owner @{tmp}/#@{int} rw,
+  owner @{tmp}/discover-@{rand6}/{,**} rw,
+  owner @{tmp}/ostree-gpg-*/ rw,
+  owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
 
   owner @{run}/user/@{uid}/.flatpak-cache rw,
   owner @{run}/user/@{uid}/.flatpak/{,**} rw,
@@ -109,8 +109,8 @@ profile plasma-discover @{exec_path} {
 
     @{HOME}/@{XDG_GPG_DIR}/*.conf r,
 
-    owner /tmp/ostree-gpg-*/ r,
-    owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
+    owner @{tmp}/ostree-gpg-*/ r,
+    owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
 
     include if exists <local/plasma-discover_gpg>
   }

apparmor.d/groups/kde/plasmashell

@@ -166,7 +166,7 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) {
   owner @{user_share_dirs}/user-places.xbel{,*} rwl,
 
         /tmp/.mount_nextcl@{rand6}/{,*} r,
-  owner /tmp/#@{int} rw,
+  owner @{tmp}/#@{int} rw,
 
         @{run}/mount/utab r,
         @{run}/user/@{uid}/gvfs/ r,

apparmor.d/groups/kde/sddm

@@ -168,9 +168,9 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) {
 
         /tmp/sddm-* rw,
         /tmp/xauth_@{rand6} rwl -> /tmp/#@{int},
-  owner /tmp/*/{,s} rw,
-  owner /tmp/#@{int} rw,
-  owner /tmp/sddm-auth* rw,
+  owner @{tmp}/*/{,s} rw,
+  owner @{tmp}/#@{int} rw,
+  owner @{tmp}/sddm-auth* rw,
 
         @{run}/faillock/[a-zA-z0-9]* rwk,
         @{run}/sddm.pid rw,

apparmor.d/groups/kde/sddm-greeter

@@ -63,8 +63,8 @@ profile sddm-greeter @{exec_path} {
   deny owner @{HOME}/#@{int} mrw,
        owner @{HOME}/.glvnd* mrw,
 
-  owner /tmp/runtime-sddm/ rw,
-  owner /tmp/sddm-:@{int}-@{rand6} rw,
+  owner @{tmp}/runtime-sddm/ rw,
+  owner @{tmp}/sddm-:@{int}-@{rand6} rw,
 
   owner @{run}/sddm/{,*} rw,
 

apparmor.d/groups/kde/sddm-xsession

@@ -61,8 +61,8 @@ profile sddm-xsession @{exec_path} {
 
   owner @{user_share_dirs}/sddm/xorg-session.log w,
 
-  owner /tmp/xsess-env-* rw,
-  owner /tmp/file* rw,
+  owner @{tmp}/xsess-env-* rw,
+  owner @{tmp}/file* rw,
 
   owner @{PROC}/@{pid}/loginuid r,
 

apparmor.d/groups/kde/startplasma

@@ -64,8 +64,8 @@ profile startplasma @{exec_path} {
   owner @{user_share_dirs}/sddm/wayland-session.log rw,
   owner @{user_share_dirs}/sddm/xorg-session.log rw,
 
-  owner /tmp/#@{int} rw,
-  owner /tmp/startplasma-{x11,wayland}.@{rand6} rwl -> /tmp/#@{int},
+  owner @{tmp}/#@{int} rw,
+  owner @{tmp}/startplasma-{x11,wayland}.@{rand6} rwl -> /tmp/#@{int},
 
   owner @{run}/user/@{uid}/ r,