feat(dbus): rewrite some dbus rules (6).

apparmor.d/abstractions/bus/desktop

@@ -4,7 +4,7 @@
 
   dbus send bus=session path=/org/freedesktop/portal/desktop
        interface=org.freedesktop.DBus.Properties
-       member=Read
+       member={GetAll,Read}
        peer=(name="{:*,org.freedesktop.portal.Desktop}", label=xdg-desktop-portal),
 
   dbus send bus=session path=/org/freedesktop/portal/desktop

apparmor.d/abstractions/bus/notification

@@ -0,0 +1,10 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+  dbus send bus=session path=/org/freedesktop/Notifications
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=:*, label=gjs-console),
+
+  include if exists <abstractions/bus/notification.d>

apparmor.d/abstractions/bus/udisk

@@ -7,6 +7,11 @@
        member=GetManagedObjects
        peer=(name=:*, label=udisksd),
 
+  dbus send bus=system path=/org/freedesktop/UDisks2/**
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=:*, label=udisksd),
+
   dbus receive bus=system path=/org/freedesktop/UDisks2
        interface=org.freedesktop.DBus.ObjectManager
        member=InterfacesAdded

apparmor.d/abstractions/dbus-gtk

@@ -1,26 +0,0 @@
-# apparmor.d - Full set of apparmor profiles
-# SPDX-License-Identifier: GPL-2.0-only
-
-  abi <abi/3.0>,
-
-  dbus (send) bus=session path=/org/gtk/vfs/mounttracker
-       interface=org.gtk.vfs.MountTracker
-       member=ListMountableInfo
-       peer=(name=:*),
-
-  dbus (send) bus=session path=/org/gtk/vfs/Daemon
-       interface=org.gtk.vfs.Daemon
-       member=ListMonitorImplementations
-       peer=(name=:*),
-
-  dbus (send) bus=session path=/org/gtk/Settings
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll
-       peer=(name=:*),
-
-  dbus (send, receive) bus=session path=/org/freedesktop/Notifications
-       interface=org.freedesktop.Notifications
-       peer=(name="{org.freedesktop.Notifications,org.freedesktop.DBus,:*}"), # all members
-
-  # Include additions to the abstraction
-  include if exists <abstractions/dbus-gtk.d>

apparmor.d/groups/freedesktop/geoclue

@@ -20,13 +20,21 @@ profile geoclue @{exec_path} flags=(attach_disconnected) {
   network inet6 stream,
   network netlink raw,
 
-  dbus (send,receive) bus=system path=/org/freedesktop/GeoClue2/{Agent,Manager}
+  dbus bind bus=system name=org.freedesktop.GeoClue2,
-       interface=org.freedesktop.{DBus.Properties,GeoClue2*},
+  dbus send bus=system path=/org/freedesktop/GeoClue2/*
+       interface=org.freedesktop.DBus.Properties
+       peer=(name="{:*,org.freedesktop.DBus}"),
+  dbus receive bus=system path=/org/freedesktop/GeoClue2/*
+       interface=org.freedesktop.DBus.Properties
+       peer=(name=:*),
+  dbus receive bus=system path=/org/freedesktop/GeoClue2/*
+       interface=org.freedesktop.GeoClue2.Manager
+       peer=(name=:*),
 
   dbus send bus=system path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
-       member={GetConnectionUnixProcessID,GetConnectionUnixUser,ReleaseName,RequestName}
+       member={GetConnectionUnixUser,GetConnectionUnixProcessID}
-       peer=(name=org.freedesktop.DBus),
+       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
 
   dbus send bus=system path=/
        interface=org.freedesktop.Avahi.Server
@@ -36,9 +44,10 @@ profile geoclue @{exec_path} flags=(attach_disconnected) {
        interface=org.freedesktop.DBus.Peer
        member=Ping,
 
-  dbus send bus=system path=/fi/w[0-9]/wpa_supplicant[0-9]
+  dbus send bus=system path=/fi/w1/wpa_supplicant1
        interface=org.freedesktop.DBus.Properties
-       member=GetAll,
+       member=PropertiesChanged 
+       peer=(name=:*, label=wpa-supplicant),
 
   dbus send bus=system path=/org/freedesktop/ModemManager[0-9]
        interface=org.freedesktop.DBus.ObjectManager
@@ -65,9 +74,6 @@ profile geoclue @{exec_path} flags=(attach_disconnected) {
        interface=org.freedesktop.DBus.Properties
        member=PropertiesChanged,
 
-  dbus bind bus=system 
-       name=org.freedesktop.GeoClue2,
-
   @{exec_path} mr,
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,

apparmor.d/groups/gnome/gnome-extension-ding

@@ -10,6 +10,7 @@ include <tunables/global>
 profile gnome-extension-ding @{exec_path} {
   include <abstractions/base>
   include <abstractions/bus/atspi>
+  include <abstractions/bus/notification>
   include <abstractions/bus/vfs/daemon>
   include <abstractions/bus/vfs/metadata>
   include <abstractions/bus/vfs/mount>
@@ -44,10 +45,10 @@ profile gnome-extension-ding @{exec_path} {
        member=GetAll
        peer=(name=:*, label=nautilus),
 
-  dbus send bus=session path=/org/freedesktop/Notifications
+  dbus send bus=system path=/net/hadess/SwitcherooControl
        interface=org.freedesktop.DBus.Properties
        member=GetAll
-       peer=(name=:*, label=gjs-console),
+       peer=(name=:*, label=switcheroo-control),
 
   dbus send bus=session path=/org/gnome/Nautilus/FileOperations*
        interface=org.freedesktop.DBus.Properties
@@ -63,8 +64,11 @@ profile gnome-extension-ding @{exec_path} {
        member=Introspect
        peer=(name=:*, label=nautilus),
 
-  dbus send bus={systemd,session} path=/org/freedesktop/DBus
+  dbus send bus=session path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus{,.Properties}
+       interface=org.freedesktop.DBus*
+       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
+  dbus send bus=system path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus*
        peer=(name=org.freedesktop.DBus, label=dbus-daemon),
 
   @{exec_path} mr,

apparmor.d/groups/gnome/gnome-session-ctl

@@ -18,7 +18,7 @@ profile gnome-session-ctl @{exec_path} {
   dbus send bus=session path=/org/freedesktop/systemd1
        interface=org.freedesktop.systemd1.Manager
        member={StartUnit,StopUnit}
-       peer=(name=org.freedesktop.systemd1),
+       peer=(name=org.freedesktop.systemd1, label="@{systemd}"),
 
   dbus send bus=session path=/org/gnome/SessionManager
        interface=org.gnome.SessionManager

apparmor.d/groups/gnome/gnome-shell

@@ -13,8 +13,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   include <abstractions/audio>
   include <abstractions/bus/account-daemon>
   include <abstractions/bus/atspi>
+  include <abstractions/bus/desktop>
+  include <abstractions/bus/gnome-screensaver>
   include <abstractions/bus/network-manager>
   include <abstractions/bus/polkit>
+  include <abstractions/bus/session-manager>
   include <abstractions/bus/upower>
   include <abstractions/bus/vfs/metadata>
   include <abstractions/bus/vfs/mount>

apparmor.d/groups/gnome/gsd-color

@@ -10,6 +10,8 @@ include <tunables/global>
 profile gsd-color @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus/atspi>
+  include <abstractions/bus/session-manager>
+  include <abstractions/bus/vfs/mount>
   include <abstractions/dbus-accessibility-strict>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
@@ -23,6 +25,10 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
   signal (receive) set=(term, hup) peer=gdm*,
 
   dbus bind bus=session name=org.gnome.SettingsDaemon.Color,
+  dbus receive bus=session path=/org/gnome/SettingsDaemon/Color
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=:*, label=gnome-shell),
 
   dbus (send, receive) bus=system path=/org/freedesktop/ColorManager{,/devices/*}
        interface=org.freedesktop.ColorManager*,
@@ -31,36 +37,6 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
        interface=org.freedesktop.DBus.Properties
        member=GetAll,
 
-  dbus receive bus=session path=/org/gnome/SettingsDaemon/Color
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll
-       peer=(name=:*, label=gnome-shell),
-
-  dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
-       interface=org.freedesktop.DBus.Properties
-       member={GetAll,PropertiesChanged}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member=EndSessionResponse
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member={CancelEndSession,QueryEndSession,EndSession,Stop}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member=RegisterClient
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
-       peer=(name=:*, label=gnome-session-binary),
-
   dbus send bus=session path=/org/gnome/Mutter/DisplayConfig
        interface=org.gnome.Mutter.DisplayConfig
        member={GetResources,GetCrtcGamma}
@@ -71,11 +47,6 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
        member=GetAll
        peer=(name=:*, label=gnome-shell),
 
-  dbus send bus=session path=/org/gtk/vfs/mounttracker
-       interface=org.gtk.vfs.MountTracker
-       member=ListMountableInfo
-       peer=(name=:*, label=gvfsd),
-
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect

apparmor.d/groups/gnome/gsd-disk-utility-notify

@@ -1,5 +1,5 @@
 # apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
+# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -9,24 +9,17 @@ include <tunables/global>
 @{exec_path} = @{lib}/gsd-disk-utility-notify
 profile gsd-disk-utility-notify @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus/udisk>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
 
-  dbus receive bus=system path=/org/freedesktop/UDisks2{,/**}
+  dbus bind bus=session name=org.gnome.Disks.NotificationMonitor,
-       interface=org.freedesktop.DBus.{Properties,ObjectManager},
-
-  dbus send bus=system path=/org/freedesktop/UDisks2
-       interface=org.freedesktop.DBus.ObjectManager
-       member=GetManagedObjects,
 
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect 
        peer=(name=:*, label=gnome-shell),
 
-  dbus bind bus=session
-       name=org.gnome.Disks.NotificationMonitor,
-
   @{exec_path} mr,
 
   include if exists <local/gsd-disk-utility-notify>

apparmor.d/groups/gnome/gsd-keyboard

@@ -10,6 +10,7 @@ include <tunables/global>
 profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus/atspi>
+  include <abstractions/bus/locale>
   include <abstractions/bus/session-manager>
   include <abstractions/bus/vfs/mount>
   include <abstractions/dbus-accessibility-strict>

apparmor.d/groups/gnome/gsd-media-keys

@@ -13,6 +13,8 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus/atspi>
   include <abstractions/bus/hostname>
   include <abstractions/bus/login>
+  include <abstractions/bus/session-manager>
+  include <abstractions/bus/vfs/mount>
   include <abstractions/dbus-accessibility-strict>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
@@ -40,31 +42,6 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
       member=GetAll
       peer=(name=:*, label=upowerd),
 
-  dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
-       interface=org.freedesktop.DBus.Properties
-       member={GetAll,PropertiesChanged}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member=EndSessionResponse
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member={CancelEndSession,QueryEndSession,EndSession,Stop}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member=RegisterClient
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
-       peer=(name=:*, label=gnome-session-binary),
-
   dbus send bus=session path=/org/gnome/Shell
        interface=org.freedesktop.DBus.Properties
        member=GetAll
@@ -110,11 +87,6 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
        member=WatchFired
        peer=(name=:*, label=gnome-shell),
 
-  dbus send bus=session path=/org/gtk/vfs/mounttracker
-       interface=org.gtk.vfs.MountTracker
-       member=ListMountableInfo
-       peer=(name=:*, label=gvfsd),
-
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect

apparmor.d/groups/gnome/gsd-power

@@ -13,6 +13,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus/atspi>
   include <abstractions/bus/gnome-screensaver>
   include <abstractions/bus/login>
+  include <abstractions/bus/session-manager>
   include <abstractions/bus/upower>
   include <abstractions/bus/vfs/mount>
   include <abstractions/dbus-accessibility-strict>
@@ -34,19 +35,6 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
        interface=org.freedesktop.DBus.Properties
        peer=(name="{org.freedesktop.DBus,:*}", label="{gsd-media-keys,gnome-shell}"),
 
-  dbus send bus=session path=/org/gnome/SessionManager{,/**}
-       interface=org.freedesktop.DBus.Properties
-       peer=(name=:*),
-  dbus send bus=session path=/org/gnome/SessionManager{,/**}
-       interface=org.gnome.SessionManager
-       peer=(name=:*),
-  dbus receive bus=session path=/org/gnome/SessionManager{,/**}
-       interface=org.gnome.SessionManager{,.*}
-       peer=(name=:*, label=gnome-session-binary),
-  dbus receive bus=session path=/org/gnome/SessionManager{,/**}
-       interface=org.freedesktop.DBus.Properties
-       peer=(name=:*, label=gnome-session-binary),
-
   dbus send bus=session path=/org/gnome/Mutter/**
        interface=org.freedesktop.DBus.{Properties,ObjectManager}
        peer=(name=:*, label=gnome-shell),
@@ -79,9 +67,14 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
        member=GetAll
        peer=(name=:*, label=power-profiles-daemon),
 
-  dbus send bus=system path=/org/freedesktop/systemd1
+  dbus send bus=system path=/org/freedesktop/login1/session/auto
        interface=org.freedesktop.DBus.Properties
-       peer=(name=org.freedesktop.systemd1, label="@{systemd}"),
+       member=GetAll
+       peer=(name=:*, label=systemd-logind),
+  dbus send bus=system path=/org/freedesktop/login1/session/auto
+       interface=org.freedesktop.login1.Session
+       member=SetBrightness
+       peer=(name=:*, label=systemd-logind),
  
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable

apparmor.d/groups/gnome/gsd-print-notifications

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{lib}/gsd-print-notifications
 profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/bus/session-manager>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
   include <abstractions/nameservice-strict>
@@ -21,50 +22,23 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) {
 
   dbus bind bus=session name=org.gnome.SettingsDaemon.PrintNotifications,
 
-  dbus (send,receive) bus=system path=/Client[0-9]*/ServiceBrowser[0-9]*
+  dbus send bus=system path=/Client@{int}/ServiceBrowser@{int}
        interface=org.freedesktop.Avahi.ServiceBrowser
-       member={CacheExhausted,AllForNow,CacheExhausted,AllForNow,Free},
+       peer=(name=org.freedesktop.Avahi, label=avahi-daemon),
-
+  dbus receive bus=system path=/Client@{int}/ServiceBrowser@{int}
+       interface=org.freedesktop.Avahi.ServiceBrowser
+       peer=(name=:*, label=avahi-daemon),
+  dbus send bus=system path=/
+       interface=org.freedesktop.Avahi.Server
+       peer=(name=org.freedesktop.Avahi, label=avahi-daemon),
   dbus send bus=system path=/
        interface=org.freedesktop.DBus.Peer
-       member=Ping,
+       member=Ping
-
+       peer=(name=org.freedesktop.Avahi, label=avahi-daemon),
-  dbus send bus=system path=/
-       interface=org.freedesktop.Avahi.Server
-       member={GetAPIVersion,GetState,ServiceBrowserNew},
-
-  dbus receive bus=system path=/
-       interface=org.freedesktop.Avahi.Server
-       member=StateChanged,
 
   dbus receive bus=system path=/org/cups/cupsd/Notifier
        interface=org.cups.cupsd.Notifier,
 
-  dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
-       interface=org.freedesktop.DBus.Properties
-       member={GetAll,PropertiesChanged}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member=EndSessionResponse
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member={CancelEndSession,QueryEndSession,EndSession,Stop}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member=RegisterClient
-       peer=(name=:*, label=gnome-session-binary),
-
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect

apparmor.d/groups/gnome/gsd-printer

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{lib}/gsd-printer
 profile gsd-printer @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/bus/session-manager>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
   include <abstractions/nameservice-strict>
@@ -20,30 +21,6 @@ profile gsd-printer @{exec_path} flags=(attach_disconnected) {
 
   dbus bind bus=system name=com.redhat.PrinterDriversInstaller,
 
-  dbus (send,receive) bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       peer=(name=:*),
-
-  dbus send bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member=EndSessionResponse
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member={EndSession,QueryEndSession,CancelEndSession,Stop}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager/Presence
-       interface=org.gnome.SessionManager.Presence
-       member=StatusChanged
-       peer=(name=:*, label=gnome-session-binary),
-
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect

apparmor.d/groups/gnome/gsd-rfkill

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{lib}/gsd-rfkill
 profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/bus/session-manager>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
 
@@ -16,6 +17,8 @@ profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
 
   network netlink raw,
 
+  dbus bind bus=session name=org.gnome.SettingsDaemon.Rfkill,
+
   dbus send bus=system path=/org/freedesktop/hostname[0-9]
        interface=org.freedesktop.DBus.Properties
        member=Get,
@@ -41,31 +44,6 @@ profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
        interface=org.freedesktop.DBus.Properties
        member=PropertiesChanged,
 
-  dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
-       interface=org.freedesktop.DBus.Properties
-       member={GetAll,PropertiesChanged}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member=EndSessionResponse
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member={CancelEndSession,QueryEndSession,EndSession,Stop}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member=RegisterClient
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
-       peer=(name=:*, label=gnome-session-binary),
-
   dbus receive bus=session path=/org/gnome/SettingsDaemon/Rfkill
        interface=org.freedesktop.DBus.Properties
        member=GetAll
@@ -81,9 +59,6 @@ profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
        member=Introspect
        peer=(name=:*, label=gnome-shell),
 
-  dbus bind bus=session
-       name=org.gnome.SettingsDaemon.Rfkill,
-
   @{exec_path} mr,
 
   @{sys}/devices/virtual/misc/rfkill/uevent r,

apparmor.d/groups/gnome/gsd-screensaver-proxy

@@ -9,46 +9,20 @@ include <tunables/global>
 @{exec_path} = @{lib}/gsd-screensaver-proxy
 profile gsd-screensaver-proxy @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/bus/session-manager>
   include <abstractions/dbus-session-strict>
 
   signal (receive) set=(term, hup) peer=gdm*,
 
-  dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
+  dbus bind bus=session name=org.freedesktop.ScreenSaver,
-       interface=org.freedesktop.DBus.Properties
-       member={GetAll,PropertiesChanged}
-       peer=(name=:*, label=gnome-session-binary),
 
-  dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
+  dbus bind bus=session name=org.gnome.SettingsDaemon.ScreensaverProxy,
-       interface=org.gnome.SessionManager.ClientPrivate
-       member=EndSessionResponse
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member={CancelEndSession,QueryEndSession,EndSession,Stop}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member=RegisterClient
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
-       peer=(name=:*, label=gnome-session-binary),
 
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect
        peer=(name=:*, label=gnome-shell),
 
-  dbus bind bus=session
-       name=org.freedesktop.ScreenSaver,
-
-  dbus bind bus=session
-       name=org.gnome.SettingsDaemon.ScreensaverProxy,
-
   @{exec_path} mr,
 
   owner /dev/tty@{int} rw,

apparmor.d/groups/gnome/gsd-sharing

@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{lib}/gsd-sharing
 profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/bus/session-manager>
   include <abstractions/bus/network-manager>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
@@ -16,6 +17,8 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
 
   signal (receive) set=(term, hup) peer=gdm*,
 
+  dbus bind bus=session name=org.gnome.SettingsDaemon.Sharing,
+
   dbus send bus=system path=/org/freedesktop
        interface=org.freedesktop.DBus.ObjectManager
        member=GetManagedObjects
@@ -56,31 +59,6 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
        member=CheckPermissions
        peer=(name=:*, label=NetworkManager),
 
-  dbus send bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member=RegisterClient
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/**}
-       interface=org.freedesktop.DBus.Properties
-       member={GetAll,PropertiesChanged}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate 
-       member=EndSessionResponse
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member={CancelEndSession,QueryEndSession,EndSession,Stop}
-       peer=(name=:*, label=gnome-session-binary),
-
   dbus send bus=session path=/org/freedesktop/systemd1
        interface=org.freedesktop.systemd1.Manager
        member=StopUnit
@@ -91,9 +69,6 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
        member=Introspect
        peer=(name=:*, label=gnome-shell),
 
-  dbus bind bus=session
-       name=org.gnome.SettingsDaemon.Sharing,
-
   dbus receive bus=system path=/org/freedesktop/NetworkManager/ActiveConnection/[0-9]*
        interface=org.freedesktop.NetworkManager.Connection.Active
        member=StateChanged,

apparmor.d/groups/gnome/gsd-smartcard

@@ -9,37 +9,15 @@ include <tunables/global>
 @{exec_path} = @{lib}/gsd-smartcard
 profile gsd-smartcard @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
-  include <abstractions/nameservice-strict>
+  include <abstractions/bus/session-manager>
   include <abstractions/dbus-session-strict>
   include <abstractions/dconf-write>
+  include <abstractions/nameservice-strict>
   include <abstractions/p11-kit>
 
   signal (receive) set=(term, hup) peer=gdm*,
 
-  dbus send bus=session path=/org/gnome/SessionManager
+  dbus bind bus=session name=org.gnome.SettingsDaemon.Smartcard,
-       interface=org.gnome.SessionManager
-       member=RegisterClient
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
-       interface=org.freedesktop.DBus.Properties
-       member={GetAll,PropertiesChanged}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member=EndSessionResponse
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member={CancelEndSession,QueryEndSession,EndSession,Stop}
-       peer=(name=:*, label=gnome-session-binary),
 
   dbus receive bus=session path=/org/gnome/SettingsDaemon/Smartcard
        interface=org.freedesktop.DBus.ObjectManager
@@ -56,9 +34,6 @@ profile gsd-smartcard @{exec_path} flags=(attach_disconnected) {
        member=Introspect
        peer=(name=:*, label=gnome-shell),
 
-  dbus bind bus=session
-       name=org.gnome.SettingsDaemon.Smartcard,
-
   @{exec_path} mr,
 
   /usr/share/dconf/profile/gdm r,

apparmor.d/groups/gnome/gsd-sound

@@ -10,49 +10,20 @@ include <tunables/global>
 profile gsd-sound @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/audio>
+  include <abstractions/bus/session-manager>
+  include <abstractions/bus/vfs/mount>
   include <abstractions/dbus-session-strict>
   include <abstractions/dconf-write>
 
   signal (receive) set=(term, hup) peer=gdm*,
 
-  dbus send bus=session path=/org/gnome/SessionManager
+  dbus bind bus=session name=org.gnome.SettingsDaemon.Sound,
-       interface=org.gnome.SessionManager
-       member=RegisterClient
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
-       interface=org.freedesktop.DBus.Properties
-       member={GetAll,PropertiesChanged}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member=EndSessionResponse
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member={CancelEndSession,QueryEndSession,EndSession,Stop}
-       peer=(name=:*, label=gnome-session-binary),
 
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect
        peer=(name=:*, label=gnome-shell),
 
-  dbus send bus=session path=/org/gtk/vfs/mounttracker
-       interface=org.gtk.vfs.MountTracker
-       member=ListMountableInfo
-       peer=(name=:*, label=gvfsd),
-
-  dbus bind bus=session
-       name=org.gnome.SettingsDaemon.Sound,
-
   @{exec_path} mr,
 
   /usr/share/dconf/profile/gdm r,

apparmor.d/groups/gnome/gsd-wacom

@@ -10,6 +10,7 @@ include <tunables/global>
 profile gsd-wacom @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus/atspi>
+  include <abstractions/bus/session-manager>
   include <abstractions/bus/vfs/mount>
   include <abstractions/dbus-accessibility-strict>
   include <abstractions/dbus-session-strict>
@@ -23,32 +24,6 @@ profile gsd-wacom @{exec_path} flags=(attach_disconnected) {
   signal (receive) set=(term, hup) peer=gdm*,
 
   dbus bind bus=session name=org.gnome.SettingsDaemon.Wacom,
-
-  dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client@{int}}
-       interface=org.freedesktop.DBus.Properties
-       member={GetAll,PropertiesChanged}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager/Client@{int}
-       interface=org.gnome.SessionManager.ClientPrivate
-       member=EndSessionResponse
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager/Client@{int}
-       interface=org.gnome.SessionManager.ClientPrivate
-       member={CancelEndSession,QueryEndSession,EndSession,Stop}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member=RegisterClient
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
-       peer=(name=:*, label=gnome-session-binary),
-
   dbus receive bus=session path=/org/gnome/SettingsDaemon/Wacom
        interface=org.freedesktop.DBus.Properties
        member=GetAll

apparmor.d/groups/gnome/gsd-xsettings

@@ -49,6 +49,11 @@ profile gsd-xsettings @{exec_path} {
        member=Get
        peer=(name=org.gnome.Shell.Introspect, label=gnome-shell),
 
+  dbus send bus=system path=/org/freedesktop/Accounts/User@{uid}
+       interface=org.freedesktop.Accounts.User
+       member=SetInputSources
+       peer=(name=:*, label=accounts-daemon),
+
   dbus send bus=session path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
        member=GetId

apparmor.d/groups/gnome/tracker-extract

@@ -9,6 +9,8 @@ include <tunables/global>
 @{exec_path} = @{lib}/tracker-extract-3
 profile tracker-extract @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/bus/vfs/daemon>
+  include <abstractions/bus/vfs/mount>
   include <abstractions/dbus-session-strict>
   include <abstractions/dconf-write>
   include <abstractions/deny-sensitive-home>
@@ -42,31 +44,21 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) {
        interface=org.gtk.Private.RemoteVolumeMonitor
        member={List,IsSupported,MountAdded}
        peer=(name=:*, label=gvfs-*-volume-monitor),
-
+  dbus receive bus=session path=/org/gtk/Private/RemoteVolumeMonitor
-  dbus receive bus=session
+       interface=org.gtk.Private.RemoteVolumeMonitor
-       interface=org.freedesktop.DBus.Introspectable
+       member={MountAdded,VolumeChanged}
-       member=Introspect
+       peer=(name=:*, label=gvfs-*-volume-monitor),
-       peer=(name=:*, label=gnome-shell),
-
-  dbus send bus=session path=/org/gtk/vfs/mounttracker
-       interface=org.gtk.vfs.MountTracker
-       member=ListMount*
-       peer=(name=:*, label=gvfsd),
-  dbus receive bus=session path=/org/gtk/vfs/mounttracker
-       interface=org.gtk.vfs.MountTracker
-       member={Mounted,ListMounts2}
-       peer=(name=:*, label=gvfsd),
-
-  dbus send bus=session path=/org/gtk/vfs/Daemon
-       interface=org.gtk.vfs.Daemon
-       member=ListMonitorImplementations 
-       peer=(name=:*, label=gvfsd),
 
   dbus send bus=session path=/org/gtk/vfs/metadata
        interface=org.gtk.vfs.Metadata
        member={GetTreeFromDevice,Remove}
        peer=(name=:*, label=gvfsd-metadata),
 
+  dbus receive bus=session
+       interface=org.freedesktop.DBus.Introspectable
+       member=Introspect
+       peer=(name=:*, label=gnome-shell),
+
   @{exec_path} mr,
 
   /usr/share/dconf/profile/gdm r,

apparmor.d/groups/gnome/tracker-miner

@@ -36,7 +36,7 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
 
   dbus send bus=session path=/org/gtk/Private/RemoteVolumeMonitor
        interface=org.gtk.Private.RemoteVolumeMonitor
-       member={List,IsSupported}
+       member={List,IsSupported,VolumeChanged,MountAdded}
        peer=(name=:*, label=gvfs-*-volume-monitor),
 
   dbus receive bus=session

apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor

@@ -11,6 +11,7 @@ include <tunables/global>
 profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus/udisk>
+  include <abstractions/bus/vfs/mount>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
   include <abstractions/dconf-write>
@@ -45,11 +46,10 @@ profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) {
        interface=org.freedesktop.DBus.ObjectManager
        member=InterfacesRemoved
        peer=(name=:*, label=udisksd),
-
+  dbus receive bus=system path=/org/freedesktop/UDisks2/**
-  dbus send bus=session path=/org/gtk/vfs/mounttracker
+       interface=org.freedesktop.DBus.Properties
-       interface=org.gtk.vfs.MountTracker
+       member=PropertiesChanged
-       member=ListMountableInfo
+       peer=(name=:*, label=udisksd),
-       peer=(name=:*, label=gvfsd),
 
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable

apparmor.d/groups/systemd/systemd-hostnamed

@@ -17,32 +17,10 @@ profile systemd-hostnamed @{exec_path}  flags=(attach_disconnected) {
   capability sys_admin,  # To set a hostname
 
   dbus bind bus=system name=org.freedesktop.hostname1,
-
-  dbus receive bus=system path=/org/freedesktop/hostname1
-       interface=org.freedesktop.hostname1
-       member=SetHostname 
-       peer=(name=:*, label=systemd//&systemd-networkd),
-
-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={RequestName,ReleaseName,GetConnectionUnixUser}
-       peer=(name=org.freedesktop.DBus),
-
-  dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
-       interface=org.freedesktop.PolicyKit1.Authority
-       member=CheckAuthorization
-       peer=(name=org.freedesktop.PolicyKit1),
-
   dbus receive bus=system path=/org/freedesktop/hostname1
        interface=org.freedesktop.DBus.Properties
-       member={Get,GetAll}
        peer=(name=:*),
 
-  dbus receive bus=system path=/org/freedesktop/hostname1
-       interface=org.freedesktop.hostname1
-       member=Set*Hostname
-       peer=(name=:*, label=hostnamectl),
-
   @{exec_path} mr,
 
   @{etc_rw}/.#hostname* rw,

apparmor.d/profiles-a-f/fwupd

@@ -11,6 +11,7 @@ include <tunables/global>
 profile fwupd @{exec_path} flags=(complain,attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus/polkit>
+  include <abstractions/bus/udisk>
   include <abstractions/bus/upower>
   include <abstractions/consoles>
   include <abstractions/dbus-strict>

apparmor.d/profiles-s-z/udisksd

@@ -66,6 +66,12 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
   dbus receive bus=system path=/org/freedesktop/UDisks2{,/**}
        interface=org.freedesktop.DBus.{Properties,ObjectManager}
        peer=(name="{:*,org.freedesktop.DBus}"),
+  dbus send bus=system path=/org/freedesktop/UDisks2{,/**}
+       interface=org.freedesktop.DBus.{Properties,ObjectManager}
+       peer=(name=org.freedesktop.DBus),
+  dbus send bus=system path=/org/freedesktop/UDisks2{,/**}
+       interface=org.freedesktop.UDisks2.Job
+       peer=(name=org.freedesktop.DBus),
 
   dbus (send,receive) bus=system path=/
        interface=org.freedesktop.DBus.Introspectable