feat(dbus): dbus rules cleanup (2)

apparmor.d/groups/gvfs/gvfs-goa-volume-monitor

@@ -12,15 +12,12 @@ profile gvfs-goa-volume-monitor @{exec_path} {
   include <abstractions/base>
   include <abstractions/dbus-session-strict>
 
-  dbus send bus=session path=/org/freedesktop/DBus
+  dbus bind bus=session name=org.gtk.vfs.GoaVolumeMonitor,
-       interface=org.freedesktop.DBus
-       member={RequestName,ReleaseName}
-       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
 
   dbus receive bus=session path=/org/gtk/Private/RemoteVolumeMonitor
        interface=org.gtk.Private.RemoteVolumeMonitor
        member={List,IsSupported}
-       peer=(name=:*, label="{gnome-shell,gnome-control-center,gnome-extension-ding,tracker-*,unconfined}"),
+       peer=(name=:*, label="{gnome-shell,nautilus,gnome-control-center,gnome-extension-ding,tracker-*,unconfined}"),
 
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
@@ -32,9 +29,6 @@ profile gvfs-goa-volume-monitor @{exec_path} {
        member=GetManagedObjects
        peer=(name=:*, label=goa-daemon),
 
-  dbus bind bus=session
-       name=org.gtk.vfs.GoaVolumeMonitor,
-
   @{exec_path} mr,
 
   include if exists <local/gvfs-goa-volume-monitor>

apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor

@@ -16,11 +16,6 @@ profile gvfs-gphoto2-volume-monitor @{exec_path} {
 
   network netlink raw,
 
-  dbus send bus=session path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={RequestName,ReleaseName}
-       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
-
   dbus receive bus=session path=/org/gtk/Private/RemoteVolumeMonitor
        interface=org.gtk.Private.RemoteVolumeMonitor
        member={List,IsSupported}

apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor

@@ -32,11 +32,6 @@ profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) {
        interface=org.freedesktop.{DBus.*,UDisks2.*}
        peer=(label=udisksd),
 
-  dbus send bus=session path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={RequestName,ReleaseName}
-       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
-
   dbus send bus=session path=/org/gtk/vfs/mounttracker
        interface=org.gtk.vfs.MountTracker
        member=ListMountableInfo

apparmor.d/groups/gvfs/gvfsd-dnssd

@@ -13,11 +13,6 @@ profile gvfsd-dnssd @{exec_path} {
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
 
-  dbus send bus=session path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={RequestName,ReleaseName}
-       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
-
   dbus send bus=system path=/
        interface=org.freedesktop.Avahi.Server
        member={Ping,GetAPIVersion,GetState,ServiceBrowserNew},

apparmor.d/groups/gvfs/gvfsd-fuse

@@ -17,7 +17,7 @@ profile gvfsd-fuse @{exec_path} {
 
   mount fstype={fuse,fuse.*} -> @{run}/user/@{uid}/gvfs/,
 
-  dbus send    bus=session path=/org/gtk/vfs/mounttracker
+  dbus send bus=session path=/org/gtk/vfs/mounttracker
        interface=org.gtk.vfs.MountTracker
        peer=(name=:*, label=gvfsd), # all members
 

apparmor.d/groups/gvfs/gvfsd-metadata

@@ -33,7 +33,7 @@ profile gvfsd-metadata @{exec_path} {
        member=GetAll
        peer=(name=:*, label=gnome-extension-ding),
 
-  dbus send    bus=session path=/org/gtk/vfs/metadata
+  dbus send bus=session path=/org/gtk/vfs/metadata
        interface=org.gtk.vfs.Metadata
        member=AttributeChanged
        peer=(name=org.freedesktop.DBus, label=gnome-extension-ding),

apparmor.d/groups/gvfs/gvfsd-network

@@ -13,11 +13,6 @@ profile gvfsd-network @{exec_path} {
   include <abstractions/dbus-session-strict>
   include <abstractions/dconf-write>
 
-  dbus send bus=session path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={RequestName,ReleaseName}
-       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
-
   dbus send bus=session path=/org/gtk/gvfs/exec_spaw/[0-9]*
        interface=org.gtk.vfs.Spawner
        member=Spawned
@@ -28,12 +23,12 @@ profile gvfsd-network @{exec_path} {
        member=Mount
        peer=(name=:*, label=gvfsd),
 
-  dbus send    bus=session path=/org/gtk/vfs/mounttracker
+  dbus send bus=session path=/org/gtk/vfs/mounttracker
        interface=org.gtk.vfs.MountTracker
        member={MountLocation,LookupMount,RegisterMount,ListMountableInfo}
        peer=(name=:*, label=gvfsd),
 
-  dbus send    bus=session path=/org/gtk/vfs/Daemon
+  dbus send bus=session path=/org/gtk/vfs/Daemon
        interface=org.gtk.vfs.Daemon
        member=GetConnection
        peer=(name=:*, label=gvfsd-dnssd),

apparmor.d/groups/gvfs/gvfsd-smb-browse

@@ -25,7 +25,7 @@ profile gvfsd-smb-browse @{exec_path} {
        member={RequestName,ReleaseName}
        peer=(name=org.freedesktop.DBus, label=dbus-daemon),
 
-  dbus send    bus=session path=/org/gtk/vfs/mounttracker
+  dbus send bus=session path=/org/gtk/vfs/mounttracker
        interface=org.gtk.vfs.MountTracker
        member=ListMounts2
        peer=(name=:*, label=gvfsd),

apparmor.d/groups/gvfs/gvfsd-trash

@@ -1,6 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2021-2022 Mikhail Morfikov
-# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
+# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -10,7 +10,6 @@ include <tunables/global>
 @{exec_path} = @{lib}/{,gvfs/}gvfsd-trash
 profile gvfsd-trash @{exec_path} {
   include <abstractions/base>
-  include <abstractions/dbus-gtk>
   include <abstractions/dbus-session-strict>
   include <abstractions/freedesktop.org>
   include <abstractions/nameservice-strict>
@@ -20,29 +19,38 @@ profile gvfsd-trash @{exec_path} {
   network inet stream,
   network inet6 stream,
 
-  dbus send bus=session path=/org/freedesktop/DBus
+  dbus bind bus=session name=org.gtk.vfs.mountpoint_@{int},
-       interface=org.freedesktop.DBus
-       member={RequestName,ReleaseName}
-       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
 
   dbus receive bus=session path=/org/gtk/vfs/Daemon
        interface=org.gtk.vfs.Daemon
        member=GetConnection
-       peer=(name=:*, label=gnome-control-center),
+       peer=(name=:*, label=gnome-shell),
 
-  dbus send bus=session path=/org/gtk/gvfs/exec_spaw/[0-9]*
+  dbus receive bus=session path=/org/gtk/vfs/mountable
+       interface=org.gtk.vfs.Mountable
+       member=Mount
+       peer=(name=:*, label=gvfsd),
+
+  dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
        interface=org.gtk.vfs.Spawner
        member=Spawned
        peer=(name=:*, label=gvfsd),
 
+  dbus send bus=session path=/org/gtk/vfs/mounttracker
+       interface=org.gtk.vfs.MountTracker
+       member=RegisterMount
+       peer=(name=:*, label=gvfsd),
+
+  dbus send bus=session path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus
+       member=RequestName
+       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
+
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect
        peer=(name=:*, label=gnome-shell),
 
-  dbus bind bus=session
-       name=org.gtk.vfs.mountpoint_[0-9]*,
-
   @{exec_path} mr,
 
   # Can restore all user files

apparmor.d/groups/systemd/systemd-machined

@@ -24,12 +24,7 @@ profile systemd-machined @{exec_path} {
   capability sys_chroot,
   capability sys_ptrace,
 
-  dbus send bus=system path=/org/freedesktop/DBus
+  dbus send bus=system path=/org/freedesktop/systemd1/{,{unit,job}/*}
-       interface=org.freedesktop.DBus
-       member=GetConnectionUnixUser
-       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
-
-  dbus send    bus=system path=/org/freedesktop/systemd1/{,{unit,job}/*}
        interface=org.freedesktop.DBus.Properties
        member=Get
        peer=(name=org.freedesktop.systemd1),
@@ -39,7 +34,7 @@ profile systemd-machined @{exec_path} {
        member=PropertiesChanged
        peer=(name=:*),
 
-  dbus send    bus=system path=/org/freedesktop/systemd1
+  dbus send bus=system path=/org/freedesktop/systemd1
        interface=org.freedesktop.systemd1.Manager
        member={StopUnit,UnrefUnit,StartTransientUnit,Subscribe}
        peer=(name=org.freedesktop.systemd1),

apparmor.d/groups/systemd/systemd-timesyncd

@@ -23,11 +23,6 @@ profile systemd-timesyncd @{exec_path} flags=(attach_disconnected) {
 
   dbus bind bus=system name=org.freedesktop.timesync1,
 
-  dbus send bus=system path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={RequestName,ReleaseName}
-       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
-
   @{exec_path} mr,
 
   @{etc_rw}/adjtime r,

apparmor.d/groups/ubuntu/update-notifier

@@ -14,6 +14,7 @@ profile update-notifier @{exec_path} {
   include <abstractions/bus/atspi>
   include <abstractions/dbus-accessibility-strict>
   include <abstractions/dbus-session-strict>
+  include <abstractions/dbus-strict>
   include <abstractions/dconf-write>
   include <abstractions/fonts>
   include <abstractions/freedesktop.org>
@@ -27,9 +28,20 @@ profile update-notifier @{exec_path} {
        interface={com.canonical.dbusmenu,org.freedesktop.DBus.Properties}
        peer=(name=:*, label=gnome-shell),
 
-  dbus (send) bus=accessibility path=/org/a11y/atspi/registry{,/**}
+  dbus send bus=session path=/org/gtk/Settings
-         interface=org.a11y.atspi.DeviceEventController
+       interface=org.freedesktop.DBus.Properties
-         peer=(name=org.a11y.atspi.Registry, label=at-spi2-registryd),
+       member=GetAll
+       peer=(name=:*, label=gsd-xsettings),
+
+  dbus send bus=session path=/StatusNotifierWatcher
+       interface=org.kde.StatusNotifierWatcher
+       member=RegisterStatusNotifierItem
+       peer=(name=:*, label=gnome-shell),
+
+  dbus receive bus=session
+       interface=org.freedesktop.DBus.Introspectable
+       member=Introspect
+       peer=(name=:*, label=gnome-shell),
 
   @{exec_path} mr,
 

apparmor.d/profiles-a-f/evince

@@ -25,12 +25,12 @@ profile evince @{exec_path} {
   deny network inet,
   deny network inet6,
 
-  dbus send    bus=session path=/org/freedesktop/DBus
+  dbus send bus=session path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
        member={RequestName,ReleaseName}
        peer=(name=org.freedesktop.DBus),
 
-  dbus send    bus=session path=/org/gtk/vfs/metadata
+  dbus send bus=session path=/org/gtk/vfs/metadata
        interface=org.gtk.vfs.Metadata
        member={Set,GetTreeFromDevice}
        peer=(name=:*),

apparmor.d/profiles-s-z/spice-vdagentd

@@ -13,8 +13,8 @@ profile spice-vdagentd @{exec_path} flags=(attach_disconnected) {
 
   capability sys_nice,
 
-  dbus receive bus=system path=/org/freedesktop/login[0-9]/session/_[0-9]*
+  dbus receive bus=system path=/org/freedesktop/login1/session/_[0-9]*
-       interface=org.freedesktop.login[0-9].Session
+       interface=org.freedesktop.login1.Session
        member=Unlock,
 
   @{exec_path} mr,

apparmor.d/profiles-s-z/thermald

@@ -17,16 +17,6 @@ profile thermald @{exec_path} flags=(attach_disconnected) {
   
   dbus (bind) bus=system name=org.freedesktop.thermald,
 
-  dbus send bus=system path=/org/freedesktop/DBus
-     interface=org.freedesktop.DBus
-     member={RequestName,ReleaseName}
-     peer=(name=org.freedesktop.DBus, label=dbus-daemon),
-
-  dbus send bus=session path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member={RequestName,ReleaseName}
-       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
-
   dbus send bus=system path=/net/hadess/PowerProfiles
        interface=org.freedesktop.DBus.Properties
        member=GetAll 

apparmor.d/profiles-s-z/udisksd

@@ -70,7 +70,8 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
 
   dbus receive bus=system path=/org/freedesktop/PolicyKit1/Authority
        interface=org.freedesktop.PolicyKit1.Authority
-       member=Changed,
+       member=Changed 
+       peer=(name=:*, label=polkitd),
 
   dbus send bus=system path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus