feat(profile): add signal from systemd-user.

2024-11-14 23:43:56 +01:00 · 2024-02-06 22:37:59 +01:00 · 2024-02-06 22:37:59 +01:00 · d0a052b7ae
commit d0a052b7ae
parent 968da5518b
48 changed files with 82 additions and 8 deletions
--- a/apparmor.d/groups/freedesktop/at-spi-bus-launcher
+++ b/apparmor.d/groups/freedesktop/at-spi-bus-launcher
@ -22,6 +22,7 @@ profile at-spi-bus-launcher @{exec_path} flags=(attach_disconnected) {
  network inet6 dgram,
  network netlink raw,

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term hup kill) peer=dbus-daemon,
  signal (receive) set=(term hup kill) peer=gdm*,
  signal (receive) set=(term hup kill) peer=gnome-session-binary,
--- a/apparmor.d/groups/freedesktop/pipewire
+++ b/apparmor.d/groups/freedesktop/pipewire
@ -19,10 +19,12 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {

  capability sys_ptrace,

-  ptrace (read),
-
  network netlink raw,

+  signal (receive) set=(cont, term) peer=systemd-user,
+
+  ptrace (read),
+
  # dbus: own bus=session name=org.pulseaudio.Server

  dbus send bus=session path=/org/freedesktop/DBus
--- a/apparmor.d/groups/freedesktop/xdg-desktop-portal
+++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal
@ -23,6 +23,8 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {

  network netlink raw,

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  ptrace (read),

  # dbus: own bus=session name=org.freedesktop.portal.Desktop path=/org/freedesktop/portal/desktop interface={org.freedesktop.DBus.Properties,org.freedesktop{,.impl}.portal.{Settings,Background}}
--- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome
+++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome
@ -29,6 +29,7 @@ profile xdg-desktop-portal-gnome @{exec_path} {

  network unix stream,

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=term peer=gdm,

  dbus bind bus=session name=org.freedesktop.impl.portal.desktop.gnome,
--- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk
+++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk
@ -29,6 +29,8 @@ profile xdg-desktop-portal-gtk @{exec_path} {
  include <abstractions/user-download>
  include <abstractions/user-write>

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  unix (send, receive, connect) type=stream peer=(addr="@/tmp/.X11-unix/*", label=gnome-shell),

  dbus bind bus=session name=org.freedesktop.impl.portal.desktop.gtk,
--- a/apparmor.d/groups/freedesktop/xdg-document-portal
+++ b/apparmor.d/groups/freedesktop/xdg-document-portal
@ -18,10 +18,11 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {

  mount fstype=fuse.portal -> @{run}/user/@{uid}/doc/,

-  ptrace (read) peer=xdg-desktop-portal,
-
+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term) peer=gdm,

+  ptrace (read) peer=xdg-desktop-portal,
+
  unix (send receive) type=stream peer=(label=xdg-document-portal//fusermount),

  # dbus: own bus=session name=org.freedesktop.portal.Documents path=/org/freedesktop/portal/documents
@ -63,6 +64,8 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {

    umount @{run}/user/@{uid}/doc/,

+    signal (receive) set=(cont, term) peer=systemd-user,
+
    unix (send receive) type=stream peer=(label=xdg-document-portal),

    @{bin}/fusermount{,3} mr,
--- a/apparmor.d/groups/freedesktop/xdg-permission-store
+++ b/apparmor.d/groups/freedesktop/xdg-permission-store
@ -13,6 +13,7 @@ profile xdg-permission-store @{exec_path} flags=(attach_disconnected) {

  capability sys_nice,

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term hup kill) peer=dbus-daemon,
  signal (receive) set=(term hup kill) peer=gdm*,

--- a/apparmor.d/groups/freedesktop/xwayland
+++ b/apparmor.d/groups/freedesktop/xwayland
@ -13,6 +13,7 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
  include <abstractions/graphics>
  include <abstractions/X-strict>

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term hup) peer=gdm*,
  signal (receive) set=(term hup) peer=gnome-shell,
  signal (receive) set=(term hup) peer=kwin_wayland,
--- a/apparmor.d/groups/gnome/evolution-addressbook-factory
+++ b/apparmor.d/groups/gnome/evolution-addressbook-factory
@ -25,6 +25,8 @@ profile evolution-addressbook-factory @{exec_path} {
  network inet6 dgram,
  network netlink raw,

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  dbus bind bus=session name=org.gnome.evolution.dataserver.AddressBook@{int},

  dbus (send, receive) bus=session path=/org/gnome/evolution/dataserver/**
--- a/apparmor.d/groups/gnome/evolution-alarm-notify
+++ b/apparmor.d/groups/gnome/evolution-alarm-notify
@ -21,6 +21,8 @@ profile evolution-alarm-notify @{exec_path} {

  network netlink raw,

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  # dbus: own bus=session name=org.gnome.Evolution-alarm-notify

  dbus (send, receive) bus=session path=/org/gnome/evolution/dataserver/**
--- a/apparmor.d/groups/gnome/evolution-calendar-factory
+++ b/apparmor.d/groups/gnome/evolution-calendar-factory
@ -24,6 +24,8 @@ profile evolution-calendar-factory @{exec_path} {
  network inet6 dgram,
  network netlink raw,

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  dbus bind bus=session name=org.gnome.evolution.dataserver.Calendar@{int},

  dbus (send, receive) bus=session path=/org/gnome/evolution/dataserver/**
--- a/apparmor.d/groups/gnome/evolution-source-registry
+++ b/apparmor.d/groups/gnome/evolution-source-registry
@ -22,6 +22,8 @@ profile evolution-source-registry @{exec_path} {
  network inet6 dgram,
  network netlink raw,

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  dbus bind bus=session name=org.gnome.evolution.dataserver.Sources@{int},
  dbus receive bus=session path=/org/gnome/evolution/dataserver/SourceManager{,/**}
       interface={org.freedesktop.DBus.ObjectManager,org.freedesktop.DBus.Properties}
--- a/apparmor.d/groups/gnome/gjs-console
+++ b/apparmor.d/groups/gnome/gjs-console
@ -27,6 +27,7 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {

  network netlink raw,

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term hup) peer=gdm*,

  # dbus: own bus=session name=org.freedesktop.Notifications
--- a/apparmor.d/groups/gnome/gnome-keyring-daemon
+++ b/apparmor.d/groups/gnome/gnome-keyring-daemon
@ -20,6 +20,7 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {

  capability ipc_lock,

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term) peer=gdm,
  signal (send) set=(term) peer=ssh-agent,

--- a/apparmor.d/groups/gnome/gnome-session-binary
+++ b/apparmor.d/groups/gnome/gnome-session-binary
@ -29,6 +29,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
  network inet6 dgram,
  network netlink raw,

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term, hup) peer=gdm*,
  signal (send) set=(term) peer=at-spi-bus-launcher,
  signal (send) set=(term) peer=gsd-*,
--- a/apparmor.d/groups/gnome/gnome-shell
+++ b/apparmor.d/groups/gnome/gnome-shell
@ -64,6 +64,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {

  ptrace (read),

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term, hup) peer=gdm*,
  signal (send),

--- a/apparmor.d/groups/gnome/gnome-shell-calendar-server
+++ b/apparmor.d/groups/gnome/gnome-shell-calendar-server
@ -13,6 +13,8 @@ profile gnome-shell-calendar-server @{exec_path} {
  include <abstractions/dconf-write>
  include <abstractions/nameservice-strict>

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  # dbus: own bus=session name=org.gnome.Shell.CalendarServer

  dbus (send receive) bus=session path=/org/gnome/evolution/dataserver/{,**}
--- a/apparmor.d/groups/gnome/gnome-software
+++ b/apparmor.d/groups/gnome/gnome-software
@ -27,6 +27,8 @@ profile gnome-software @{exec_path} {
  mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/,
  umount /var/tmp/flatpak-cache-*/*/,

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  @{exec_path} mr,

  @{bin}/baobab              rPUx,
--- a/apparmor.d/groups/gnome/gnome-terminal-server
+++ b/apparmor.d/groups/gnome/gnome-terminal-server
@ -18,6 +18,7 @@ profile gnome-terminal-server @{exec_path} {
  include <abstractions/dconf-write>
  include <abstractions/gnome-strict>

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (send) set=(hup) peer=htop,
  signal (send) set=(term hup kill) peer=unconfined,

--- a/apparmor.d/groups/gnome/goa-daemon
+++ b/apparmor.d/groups/gnome/goa-daemon
@ -25,6 +25,8 @@ profile goa-daemon @{exec_path} {
  network inet6 dgram,
  network netlink raw,

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  # dbus: own bus=session name=org.gnome.OnlineAccounts

  dbus send bus=session path=/org/gnome/Identity
--- a/apparmor.d/groups/gnome/goa-identity-service
+++ b/apparmor.d/groups/gnome/goa-identity-service
@ -12,6 +12,8 @@ profile goa-identity-service @{exec_path} {
  include <abstractions/authentication>
  include <abstractions/bus-session>

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  # dbus: own bus=session name=org.gnome.Identity

  dbus send bus=session path=/org/gnome/OnlineAccounts
--- a/apparmor.d/groups/gnome/gsd-a11y-settings
+++ b/apparmor.d/groups/gnome/gsd-a11y-settings
@ -13,6 +13,7 @@ profile gsd-a11y-settings @{exec_path} flags=(attach_disconnected) {
  include <abstractions/bus/org.gnome.SessionManager>
  include <abstractions/dconf-write>

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term, hup) peer=gdm*,

  # dbus: own bus=session name=org.gnome.SettingsDaemon.A11ySettings
--- a/apparmor.d/groups/gnome/gsd-color
+++ b/apparmor.d/groups/gnome/gsd-color
@ -22,6 +22,7 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
  include <abstractions/gnome-strict>
  include <abstractions/nameservice-strict>

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term, hup) peer=gdm*,

  # dbus: own bus=session name=org.gnome.SettingsDaemon.Color
--- a/apparmor.d/groups/gnome/gsd-datetime
+++ b/apparmor.d/groups/gnome/gsd-datetime
@ -13,6 +13,7 @@ profile gsd-datetime @{exec_path} flags=(attach_disconnected) {
  include <abstractions/bus/org.gnome.SessionManager>
  include <abstractions/dconf-write>

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term, hup) peer=gdm*,

  # dbus: own bus=session name=org.gnome.SettingsDaemon.Datetime
--- a/apparmor.d/groups/gnome/gsd-disk-utility-notify
+++ b/apparmor.d/groups/gnome/gsd-disk-utility-notify
@ -13,6 +13,8 @@ profile gsd-disk-utility-notify @{exec_path} {
  include <abstractions/bus-system>
  include <abstractions/bus/org.freedesktop.UDisks2>

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  # dbus: own bus=session name=org.gnome.Disks.NotificationMonitor

  dbus receive bus=session
--- a/apparmor.d/groups/gnome/gsd-housekeeping
+++ b/apparmor.d/groups/gnome/gsd-housekeeping
@ -16,6 +16,7 @@ profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) {
  include <abstractions/dconf-write>
  include <abstractions/thumbnails-cache-read>

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term, hup) peer=gdm*,
  signal (receive) set=(term, hup) peer=gnome*,

--- a/apparmor.d/groups/gnome/gsd-keyboard
+++ b/apparmor.d/groups/gnome/gsd-keyboard
@ -21,6 +21,7 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
  include <abstractions/gnome-strict>
  include <abstractions/nameservice-strict>

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term, hup) peer=gdm*,

  # dbus: own bus=session name=org.gnome.SettingsDaemon.Keyboard
--- a/apparmor.d/groups/gnome/gsd-media-keys
+++ b/apparmor.d/groups/gnome/gsd-media-keys
@ -24,6 +24,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
  include <abstractions/gnome-strict>
  include <abstractions/nameservice-strict>

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term, hup) peer=gdm*,

  network netlink raw,
--- a/apparmor.d/groups/gnome/gsd-power
+++ b/apparmor.d/groups/gnome/gsd-power
@ -31,6 +31,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {

  network netlink raw,

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term, hup) peer=gdm*,

  # dbus: own bus=session name=org.gnome.SettingsDaemon.Power
--- a/apparmor.d/groups/gnome/gsd-print-notifications
+++ b/apparmor.d/groups/gnome/gsd-print-notifications
@ -18,6 +18,7 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) {
  network inet stream,
  network inet6 stream,

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term, hup) peer=gdm*,
  signal (send) set=(hup) peer=gsd-printer,

--- a/apparmor.d/groups/gnome/gsd-printer
+++ b/apparmor.d/groups/gnome/gsd-printer
@ -14,6 +14,7 @@ profile gsd-printer @{exec_path} flags=(attach_disconnected) {
  include <abstractions/bus/org.gnome.SessionManager>
  include <abstractions/nameservice-strict>

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term, hup) peer=gdm*,
  signal (receive) set=(hup) peer=gsd-print-notifications,

--- a/apparmor.d/groups/gnome/gsd-rfkill
+++ b/apparmor.d/groups/gnome/gsd-rfkill
@ -16,6 +16,7 @@ profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
  include <abstractions/bus/org.freedesktop.NetworkManager>
  include <abstractions/bus/org.gnome.SessionManager>

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term, hup) peer=gdm*,

  network netlink raw,
--- a/apparmor.d/groups/gnome/gsd-screensaver-proxy
+++ b/apparmor.d/groups/gnome/gsd-screensaver-proxy
@ -12,6 +12,7 @@ profile gsd-screensaver-proxy @{exec_path} flags=(attach_disconnected) {
  include <abstractions/bus-session>
  include <abstractions/bus/org.gnome.SessionManager>

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term, hup) peer=gdm*,

  # dbus: own bus=session name=org.freedesktop.ScreenSaver
--- a/apparmor.d/groups/gnome/gsd-sharing
+++ b/apparmor.d/groups/gnome/gsd-sharing
@ -15,6 +15,7 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
  include <abstractions/bus/org.gnome.SessionManager>
  include <abstractions/dconf-write>

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term, hup) peer=gdm*,

  # dbus: own bus=session name=org.gnome.SettingsDaemon.Sharing
--- a/apparmor.d/groups/gnome/gsd-smartcard
+++ b/apparmor.d/groups/gnome/gsd-smartcard
@ -15,6 +15,7 @@ profile gsd-smartcard @{exec_path} flags=(attach_disconnected) {
  include <abstractions/nameservice-strict>
  include <abstractions/p11-kit>

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term, hup) peer=gdm*,

  # dbus: own bus=session name=org.gnome.SettingsDaemon.Smartcard
--- a/apparmor.d/groups/gnome/gsd-sound
+++ b/apparmor.d/groups/gnome/gsd-sound
@ -15,6 +15,7 @@ profile gsd-sound @{exec_path} flags=(attach_disconnected) {
  include <abstractions/bus/org.gtk.vfs.MountTracker>
  include <abstractions/dconf-write>

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term, hup) peer=gdm*,

  # dbus: own bus=session name=org.gnome.SettingsDaemon.Sound
--- a/apparmor.d/groups/gnome/gsd-usb-protection
+++ b/apparmor.d/groups/gnome/gsd-usb-protection
@ -11,6 +11,8 @@ profile gsd-usb-protection @{exec_path} {
  include <abstractions/base>
  include <abstractions/dconf-write>

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  @{exec_path} mr,

  /usr/share/glib-2.0/schemas/gschemas.compiled r,
--- a/apparmor.d/groups/gnome/gsd-wacom
+++ b/apparmor.d/groups/gnome/gsd-wacom
@ -19,6 +19,7 @@ profile gsd-wacom @{exec_path} flags=(attach_disconnected) {
  include <abstractions/gnome-strict>
  include <abstractions/nameservice-strict>

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (receive) set=(term, hup) peer=gdm*,

  # dbus: own bus=session name=org.gnome.SettingsDaemon.Wacom
--- a/apparmor.d/groups/gnome/gsd-xsettings
+++ b/apparmor.d/groups/gnome/gsd-xsettings
@ -30,6 +30,8 @@ profile gsd-xsettings @{exec_path} {
  network inet6 dgram,
  network netlink raw,

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  # dbus: own bus=session name=org.gnome.SettingsDaemon.XSettings
  # dbus: own bus=session name=org.gtk.Settings

--- a/apparmor.d/groups/gnome/mutter-x11-frames
+++ b/apparmor.d/groups/gnome/mutter-x11-frames
@ -17,6 +17,8 @@ profile mutter-x11-frames @{exec_path} {
  include <abstractions/graphics>
  include <abstractions/nameservice-strict>

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  @{exec_path} mr,

  /usr/share/dconf/profile/gdm r,
--- a/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor
+++ b/apparmor.d/groups/gvfs/gvfs-afc-volume-monitor
@ -12,6 +12,8 @@ profile gvfs-afc-volume-monitor @{exec_path} {
  include <abstractions/base>
  include <abstractions/bus-session>

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  # dbus: own bus=session name=org.gtk.vfs.AfcVolumeMonitor interface=org.gtk.Private.RemoteVolumeMonitor path=/org/gtk/Private/RemoteVolumeMonitor

  dbus receive bus=session
--- a/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor
+++ b/apparmor.d/groups/gvfs/gvfs-goa-volume-monitor
@ -12,6 +12,8 @@ profile gvfs-goa-volume-monitor @{exec_path} {
  include <abstractions/base>
  include <abstractions/bus-session>

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  dbus bind bus=session name=org.gtk.vfs.GoaVolumeMonitor,
  dbus (send, receive) bus=session path=/org/gtk/Private/RemoteVolumeMonitor
       interface=org.gtk.Private.RemoteVolumeMonitor
--- a/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor
+++ b/apparmor.d/groups/gvfs/gvfs-gphoto2-volume-monitor
@ -16,6 +16,8 @@ profile gvfs-gphoto2-volume-monitor @{exec_path} {

  network netlink raw,

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  dbus bind bus=session name=org.gtk.vfs.GPhoto2VolumeMonitor,
  dbus (send, receive) bus=session path=/org/gtk/Private/RemoteVolumeMonitor
       interface=org.gtk.Private.RemoteVolumeMonitor
--- a/apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor
+++ b/apparmor.d/groups/gvfs/gvfs-mtp-volume-monitor
@ -15,6 +15,8 @@ profile gvfs-mtp-volume-monitor @{exec_path} {

  network netlink raw,

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  dbus bind bus=session name=org.gtk.vfs.MTPVolumeMonitor,
  dbus (send, receive) bus=session path=/org/gtk/Private/RemoteVolumeMonitor
       interface=org.gtk.Private.RemoteVolumeMonitor
--- a/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor
+++ b/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor
@ -26,6 +26,7 @@ profile gvfs-udisks2-volume-monitor @{exec_path} flags=(attach_disconnected) {
  network inet6 stream,
  network netlink raw,

+  signal (receive) set=(cont, term) peer=systemd-user,
  signal (send) set=(term, kill) peer=mount,

  ptrace (read),
--- a/apparmor.d/groups/gvfs/gvfsd
+++ b/apparmor.d/groups/gvfs/gvfsd
@ -12,6 +12,8 @@ profile gvfsd @{exec_path} {
  include <abstractions/base>
  include <abstractions/bus-session>

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  dbus bind bus=session name=org.gtk.vfs.Daemon,

  dbus send bus=session path=/org/gtk/vfs/mounttracker
--- a/apparmor.d/groups/gvfs/gvfsd-fuse
+++ b/apparmor.d/groups/gvfs/gvfsd-fuse
@ -13,10 +13,12 @@ profile gvfsd-fuse @{exec_path} {
  include <abstractions/bus-session>
  include <abstractions/bus/org.gtk.vfs.MountTracker>

-  unix (send,receive) type=stream addr=none peer=(label=gvfsd-fuse//fusermount),
-
  mount fstype={fuse,fuse.*} -> @{run}/user/@{uid}/gvfs/,

+  signal (receive) set=(cont, term) peer=systemd-user,
+
+  unix (send,receive) type=stream addr=none peer=(label=gvfsd-fuse//fusermount),
+
  dbus send bus=session path=/org/gtk/vfs/mounttracker
       interface=org.gtk.vfs.MountTracker
       member=RegisterFuse
@ -42,11 +44,13 @@ profile gvfsd-fuse @{exec_path} {
    capability dac_read_search,
    capability sys_admin,  # To mount anything

-    unix (send,receive) type=stream addr=none peer=(label=gvfsd-fuse),
-
    mount fstype={fuse,fuse.*} -> @{run}/user/@{uid}/gvfs/,
    umount @{run}/user/@{uid}/**/,

+    signal (receive) set=(cont, term) peer=systemd-user,
+
+    unix (send,receive) type=stream addr=none peer=(label=gvfsd-fuse),
+
    @{bin}/fusermount{,3} mr,

    /etc/fuse{,3}.conf r,
--- a/apparmor.d/profiles-s-z/wireplumber
+++ b/apparmor.d/profiles-s-z/wireplumber
@ -23,6 +23,8 @@ profile wireplumber @{exec_path} {
  network bluetooth stream,
  network netlink raw,

+  signal (receive) set=(cont, term) peer=systemd-user,
+
  dbus bind bus=session name=org.freedesktop.ReserveDevice1.Audio0,

  dbus receive bus=session