fixes

apparmor.d/groups/freedesktop/at-spi2-registryd

@@ -72,7 +72,7 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
   dbus send bus=session path=/org/a11y/bus
        interface=org.a11y.Bus
        member=GetAddress
-       peer=(name=org.a11y.Bus, label="{at-spi-bus-launcher,unconfined}"),
+       peer=(name=org.a11y.Bus, label=at-spi-bus-launcher),
 
   dbus receive bus=session path=/
        interface=org.freedesktop.DBus.Introspectable

apparmor.d/groups/gnome/tracker-miner

@@ -66,7 +66,7 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
 
   dbus receive bus=session path=/org/freedesktop/Tracker3/Miner/**
        interface=org.freedesktop.Tracker3.Miner
-       peer=(name=:*, label=tracker-extract),
+       peer=(name=:*, label=tracker-extract), # all members
 
   dbus receive bus=session path=/{,org}
        interface=org.freedesktop.DBus.Introspectable

apparmor.d/groups/virt/virtiofsd

@@ -6,6 +6,7 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{LOCAL_SHARED_DIRS} = /var/lib/libvirt/shared
+include if exists <local/tunables/virtiofsd>
 
 @{exec_path} = /{,usr/}lib/qemu/virtiofsd
 profile virtiofsd @{exec_path} flags=(attach_disconnected) {

apparmor.d/profiles-m-r/pkexec

@@ -23,8 +23,8 @@ profile pkexec @{exec_path} {
   capability setgid,  # gdbus
   capability setuid,  # gmain
   capability sys_ptrace,
-  capability sys_nice,
   capability sys_resource,
+  audit deny capability sys_nice,
 
   ptrace (read),
 

apparmor.d/profiles-m-r/qbittorrent

@@ -78,7 +78,7 @@ profile qbittorrent @{exec_path} {
        member=Get
        peer=(name=org.kde.StatusNotifierWatcher),
    
-  dbus receive bus=session path={/StatusNotifierItem,/MenuBar}
+  dbus receive bus=session path="{/StatusNotifierItem,/MenuBar}"
        interface=org.freedesktop.DBus.Properties
        member=GetAll
        peer=(name=:*),