feat(abs): common/gnome: remove open_path from the abs, add bus accessibility.

apparmor.d/abstractions/common/gnome

@@ -4,24 +4,30 @@
 
 # Minimal set of rules for all gnome based UI application.
 
+  include <abstractions/bus-accessibility>
   include <abstractions/bus-session>
   include <abstractions/bus/org.a11y>
   include <abstractions/dconf-write>
   include <abstractions/gnome-strict>
   include <abstractions/graphics>
 
-  @{open_path}  rPx -> child-open-help,
-
   /usr/share/@{profile_name}/{,**} r,
 
+  / r,
+
   owner @{user_cache_dirs}/@{profile_name}/ rw,
-  owner @{user_cache_dirs}/@{profile_name}/** rwlk,
+  owner @{user_cache_dirs}/@{profile_name}/** rwlk -> @{user_cache_dirs}/@{profile_name}/**,
 
   owner @{user_config_dirs}/@{profile_name}/ rw,
-  owner @{user_config_dirs}/@{profile_name}/** rwlk,
+  owner @{user_config_dirs}/@{profile_name}/** rwlk -> @{user_config_dirs}/@{profile_name}/**,
 
   owner @{user_share_dirs}/@{profile_name}/ rw,
-  owner @{user_share_dirs}/@{profile_name}/** rwlk,
+  owner @{user_share_dirs}/@{profile_name}/** rwlk -> @{user_share_dirs}/@{profile_name}/**,
+
+        @{sys}/fs/cgroup/user.slice/cpu.max r,
+        @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r,
+        @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r,
+  owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r,
 
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,

apparmor.d/groups/browsers/epiphany

@@ -10,7 +10,6 @@ include <tunables/global>
 profile epiphany @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/audio-server>
-  include <abstractions/bus-accessibility>
   include <abstractions/bus-system>
   include <abstractions/bus/org.freedesktop.GeoClue2>
   include <abstractions/common/bwrap>
@@ -33,6 +32,8 @@ profile epiphany @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
+  @{open_path}  rPx -> child-open,
+
   @{bin}/bwrap           rix,
   @{bin}/xdg-dbus-proxy  rix,
   @{lib}/{,@{multiarch}/}webkit{,2}gtk-*/WebKit{Web,Network}Process rix,
@@ -64,7 +65,6 @@ profile epiphany @{exec_path} flags=(attach_disconnected) {
         @{PROC}/zoneinfo r,
   owner @{PROC}/@{pid}/smaps r,
   owner @{PROC}/@{pid}/statm r,
-  owner @{PROC}/@{pid}/task/@{tid}/comm rw,
 
   deny @{user_share_dirs}/gvfs-metadata/* r,
 

apparmor.d/groups/gnome/gnome-calculator

@@ -21,6 +21,8 @@ profile gnome-calculator @{exec_path} {
 
   @{exec_path} mr,
 
+  @{open_path}  rPx -> child-open-help,
+
   include if exists <local/gnome-calculator>
 }
 

apparmor.d/groups/gnome/gnome-calendar

@@ -9,9 +9,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/gnome-calendar
 profile gnome-calendar @{exec_path} {
   include <abstractions/base>
-  include <abstractions/bus-accessibility>
   include <abstractions/bus-system>
-  include <abstractions/bus/org.a11y>
   include <abstractions/bus/org.freedesktop.login1>
   include <abstractions/bus/org.freedesktop.NetworkManager>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
@@ -40,6 +38,7 @@ profile gnome-calendar @{exec_path} {
        peer=(name=:*, label=evolution-source-registry),
 
   @{exec_path} mr,
+  @{open_path}  rPx -> child-open-help,
 
   /usr/share/evolution-data-server/{,**} r,
   /usr/share/libgweather/Locations.xml r,

apparmor.d/groups/gnome/gnome-clocks

@@ -10,9 +10,7 @@ include <tunables/global>
 profile gnome-clocks @{exec_path} {
   include <abstractions/base>
   include <abstractions/audio-client>
-  include <abstractions/bus-accessibility>
   include <abstractions/bus-session>
-  include <abstractions/bus/org.a11y>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
   include <abstractions/bus/org.gtk.vfs.MountTracker>
   include <abstractions/common/gnome>
@@ -24,6 +22,7 @@ profile gnome-clocks @{exec_path} {
   #aa:dbus own bus=session name=org.gnome.clocks
 
   @{exec_path} mr,
+  @{open_path}  rPx -> child-open-help,
 
   include if exists <local/gnome-clocks>
 }

apparmor.d/groups/gnome/gnome-contacts

@@ -9,8 +9,6 @@ include <tunables/global>
 @{exec_path} = @{bin}/gnome-contacts
 profile gnome-contacts @{exec_path} {
   include <abstractions/base>
-  include <abstractions/bus-accessibility>
-  include <abstractions/bus/org.a11y>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
   include <abstractions/common/gnome>
   include <abstractions/gstreamer>
@@ -26,6 +24,7 @@ profile gnome-contacts @{exec_path} {
   #aa:dbus talk bus=session name=org.gnome.OnlineAccounts label=goa-daemon
 
   @{exec_path} mr,
+  @{open_path}  rPx -> child-open-help,
 
   owner @{user_cache_dirs}/evolution/addressbook/{,**} r,
   owner @{user_share_dirs}/folks/relationships.ini r,

apparmor.d/groups/gnome/gnome-extensions-app

@@ -16,6 +16,7 @@ profile gnome-extensions-app @{exec_path} {
 
   @{sh_path}         rix,
   @{bin}/gjs-console rix,
+  @{open_path}       rPx -> child-open-help,
 
   /usr/share/gnome-shell/org.gnome.Extensions* r,
   /usr/share/terminfo/** r,

apparmor.d/groups/gnome/gnome-firmware

@@ -24,6 +24,7 @@ profile gnome-firmware @{exec_path} {
   #aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind
 
   @{exec_path} mr,
+  @{open_path}  rPx -> child-open-help,
 
   include if exists <local/gnome-firmware>
 }

apparmor.d/groups/gnome/gnome-font-viewer

@@ -12,6 +12,7 @@ profile gnome-font-viewer @{exec_path} {
   include <abstractions/common/gnome>
 
   @{exec_path} mr,
+  @{open_path}  rPx -> child-open-help,
 
   include if exists <local/gnome-font-viewer>
 }

apparmor.d/groups/gnome/gnome-logs

@@ -13,6 +13,7 @@ profile gnome-logs @{exec_path} {
   include <abstractions/user-download-strict>
 
   @{exec_path} mr,
+  @{open_path}  rPx -> child-open-help,
 
   /etc/machine-id r,
 

apparmor.d/groups/gnome/gnome-maps

@@ -22,6 +22,8 @@ profile gnome-maps @{exec_path} {
 
   @{exec_path} mr,
 
+  @{open_path}  rPx -> child-open-help,
+
   audit @{bin}/gjs-console rix,
 
   owner @{user_pictures_dirs}/** rw,

apparmor.d/groups/gnome/gnome-music

@@ -28,6 +28,9 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) {
   #aa:dbus talk bus=session name=org.freedesktop.Tracker3.Writeback label=tracker-writeback
 
   @{exec_path} mr,
+
+  @{open_path}  rPx -> child-open-help,
+
   @{bin}/ r,
   @{bin}/env r,
   @{bin}/python3.@{int} rix,

apparmor.d/groups/gnome/gnome-recipes

@@ -24,6 +24,7 @@ profile gnome-recipes @{exec_path} {
   @{exec_path} mr,
 
   @{bin}/tar rix,
+  @{open_path}  rPx -> child-open-help,
 
   include if exists <local/gnome-recipes>
 }

apparmor.d/groups/gnome/gnome-text-editor

@@ -19,6 +19,8 @@ profile gnome-text-editor @{exec_path} {
 
   @{exec_path} mr,
 
+  @{open_path}  rPx -> child-open-help,
+
   owner @{user_share_dirs}/org.gnome.TextEditor/{,**} rw,
 
   owner @{PROC}/@{pid}/mountinfo r,

apparmor.d/groups/gnome/gnome-tour

@@ -13,6 +13,7 @@ profile gnome-tour @{exec_path} {
   include <abstractions/nameservice-strict>
 
   @{exec_path} mr,
+  @{open_path}  rPx -> child-open-help,
 
   include if exists <local/gnome-tour>
 }

apparmor.d/groups/gnome/gnome-weather

@@ -23,6 +23,7 @@ profile gnome-weather @{exec_path} {
   @{exec_path} mr,
 
   @{bin}/gjs-console rix,
+  @{open_path}  rPx -> child-open-help,
 
   /usr/share/org.gnome.Weather/{,**} r,
 

apparmor.d/groups/gnome/yelp

@@ -10,8 +10,6 @@ include <tunables/global>
 profile yelp @{exec_path} {
   include <abstractions/base>
   include <abstractions/audio-client>
-  include <abstractions/bus-accessibility>
-  include <abstractions/bus/org.a11y>
   include <abstractions/common/gnome>
 
   network netlink raw,
@@ -19,6 +17,7 @@ profile yelp @{exec_path} {
   #aa:dbus own bus=session name=org.gnome.Yelp
 
   @{exec_path} mr,
+  @{open_path}  rPx -> child-open-help,
 
   @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitNetworkProcess rix,
   @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitWebProcess rix,
@@ -32,7 +31,7 @@ profile yelp @{exec_path} {
   @{sys}/devices/virtual/dmi/id/chassis_type r,
   @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/app-gnome-yelp-*.scope/memory.* r,
 
-  owner @{sys}/fs/cgroup/user.slice/user-1000.slice/user@1000.service/app.slice/*.slice/*/memory.* r,
+  owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*.slice/*/memory.* r,
 
         @{PROC}/zoneinfo r,
   owner @{PROC}/@{pid}/cgroup r,

apparmor.d/profiles-a-f/baobab

@@ -17,6 +17,8 @@ profile baobab @{exec_path} {
 
   @{exec_path} mr,
 
+  @{open_path}  rPx -> child-open-help,
+
   # As a directory tree analyzer it needs full access to the filesystem
   / r,
   /** r,

apparmor.d/profiles-a-f/file-roller

@@ -9,8 +9,6 @@ include <tunables/global>
 @{exec_path} = @{bin}/file-roller
 profile file-roller @{exec_path} {
   include <abstractions/base>
-  include <abstractions/bus-accessibility>
-  include <abstractions/bus/org.a11y>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
   include <abstractions/common/gnome>
   include <abstractions/nameservice-strict>
@@ -23,6 +21,8 @@ profile file-roller @{exec_path} {
 
   @{exec_path} mr,
 
+  @{open_path}  rPx -> child-open-help,
+
   # Archivers
   @{bin}/7z            rix,
   @{bin}/7zz           rix,
@@ -38,8 +38,6 @@ profile file-roller @{exec_path} {
   @{bin}/zstd          rix,
   @{lib}/p7zip/7z      rix,
 
-  / r,
-
   @{run}/mount/utab r,
 
   owner @{PROC}/@{pid}/mountinfo r,

apparmor.d/profiles-a-f/foliate

@@ -32,6 +32,7 @@ profile foliate @{exec_path} flags=(attach_disconnected) {
   @{bin}/gjs-console     rix,
   @{bin}/xdg-dbus-proxy  rix,
   @{bin}/speech-dispatcher rPx,
+  @{open_path}             rPx -> child-open-help,
 
   @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitNetworkProcess  rix,
   @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitWebProcess      rix,
@@ -65,7 +66,6 @@ profile foliate @{exec_path} flags=(attach_disconnected) {
   owner @{PROC}/@{pid}/smaps r,
   owner @{PROC}/@{pid}/stat r,
   owner @{PROC}/@{pid}/statm r,
-  owner @{PROC}/@{pid}/task/@{tid}/comm rw,
   owner @{PROC}/@{pid}/task/@{tid}/stat r,
 
   deny @{user_share_dirs}/gvfs-metadata/* r,

apparmor.d/profiles-a-f/fractal

@@ -23,23 +23,17 @@ profile fractal @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
-  /usr/share/xml/iso-codes/{,**} r,
+  @{open_path}  rPx -> child-open-help,
 
-  / r,
+  /usr/share/xml/iso-codes/{,**} r,
 
   owner @{tmp}/.@{rand6} rw, 
   owner @{tmp}/.goutputstream-@{rand6} rw,
   owner @{tmp}/@{rand6} rw,
 
-        @{sys}/fs/cgroup/user.slice/cpu.max r,
-        @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r,
-        @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r,
-  owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r,
-
         @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
   owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/mountinfo r,
-  owner @{PROC}/@{pid}/task/@{tid}/comm rw,
 
   /dev/ r,
 

apparmor.d/profiles-s-z/snapshot

@@ -17,11 +17,11 @@ profile snapshot @{exec_path} {
 
   @{exec_path} mr,
 
+  @{open_path}  rPx -> child-open-help,
+
   owner @{user_pictures_dirs}/Camera/{,**} rw,
   owner @{user_videos_dirs}/Camera/{,**} rw,
 
-  owner @{PROC}/@{pid}/task/@{tid}/comm rw,
-
   include if exists <local/snapshot>
 }
 

apparmor.d/profiles-s-z/totem

@@ -10,8 +10,6 @@ include <tunables/global>
 profile totem @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/audio-client>
-  include <abstractions/bus-accessibility>
-  include <abstractions/bus/org.a11y>
   include <abstractions/bus/org.freedesktop.ScreenSaver>
   include <abstractions/bus/org.gnome.SessionManager>
   include <abstractions/common/gnome>
@@ -30,6 +28,7 @@ profile totem @{exec_path} flags=(attach_disconnected) {
   @{exec_path} mr,
 
   @{bin}/bwrap rCx -> bwrap,
+  @{open_path}  rPx -> child-open-help,
 
   /usr/share/xml/iso-codes/{,**} r,
   /usr/share/grilo-plugins/{,**} r,
@@ -56,7 +55,6 @@ profile totem @{exec_path} flags=(attach_disconnected) {
   @{run}/mount/utab r,
 
   owner @{PROC}/@{pid}/mountinfo r,
-  owner @{PROC}/@{pid}/task/@{tid}/comm w,
 
   deny @{user_share_dirs}/gvfs-metadata/* r,