feat(tunanle): add the sqlhex variable.

apparmor.d/abstractions/common/app

@@ -59,9 +59,10 @@
   owner @{run}/user/@{uid}/** rwlk -> @{run}/user/@{uid}/**,
   owner @{user_games_dirs}/** rmix,
 
-  owner /var/cache/tmp/** rwlk -> /var/cache/tmp/**,
   owner @{tmp}/** rmwk,
   owner /dev/shm/** rwlk -> /dev/shm/**,
+  owner /var/cache/tmp/** rwlk -> /var/cache/tmp/**,
+  owner /var/tmp/etilqs_@{sqlhex} rw,
 
   @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
 

apparmor.d/groups/flatpak/flatpak-app

@@ -82,7 +82,6 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
 
   /var/lib/flatpak/app/{,**} r,
   /var/lib/flatpak/exports/** rw,
-  /var/tmp/etilqs_@{hex16} rw,
 
         @{run}/.userns r,
         @{run}/parent/** r,

apparmor.d/groups/gnome/gnome-music

@@ -51,8 +51,8 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) {
   @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
 
   owner @{tmp}/grilo-plugin-cache-[0-9A-Z]*/ rw,
-  owner /var/tmp/etilqs_@{hex15} rw,
+  owner @{tmp}/etilqs_@{sqlhex} rw,
-  owner /var/tmp/etilqs_@{hex16} rw,
+  owner /var/tmp/etilqs_@{sqlhex} rw,
 
         @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
   owner @{PROC}/@{pid}/mounts r,

apparmor.d/groups/gnome/localsearch

@@ -47,12 +47,8 @@ profile localsearch @{exec_path} flags=(attach_disconnected) {
   owner @{user_cache_dirs}/tracker3/files/ rw,
   owner @{user_cache_dirs}/tracker3/files/** rwk,
 
-  owner /var/tmp/etilqs_@{hex15} rw,
+  owner @{tmp}/etilqs_@{sqlhex} rw,
-  owner /var/tmp/etilqs_@{hex16} rw,
+  owner /var/tmp/etilqs_@{sqlhex} rw,
-  owner @{tmp}/etilqs_@{hex12}@{h} rw,
-  owner @{tmp}/etilqs_@{hex12}@{hex2} rw,
-  owner @{tmp}/etilqs_@{hex15} rw,
-  owner @{tmp}/etilqs_@{hex16} rw,
 
   @{run}/mount/utab r,
 

apparmor.d/groups/gnome/tracker-miner

@@ -63,10 +63,8 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
   owner @{gdm_config_dirs}/dconf/user r,
   owner @{gdm_share_dirs}/applications/ r,
 
-  owner /var/tmp/etilqs_@{hex15} rw,
+  owner @{tmp}/etilqs_@{sqlhex} rw,
-  owner /var/tmp/etilqs_@{hex16} rw,
+  owner /var/tmp/etilqs_@{sqlhex} rw,
-  owner @{tmp}/etilqs_@{hex15} rw,
-  owner @{tmp}/etilqs_@{hex16} rw,
 
   # Allow to search user files
   owner @{HOME}/{,**} r,

apparmor.d/profiles-a-f/dropbox

@@ -61,7 +61,8 @@ profile dropbox @{exec_path} {
   # Dropbox first tries the /tmp/ dir, and if it's denied it uses the /var/tmp/ dir instead
   owner @{tmp}/dropbox-antifreeze-* rw,
   owner @{tmp}/#@{int} rw,
-  owner /var/tmp/etilqs_@{hex16} rw,
+  owner @{tmp}/etilqs_@{sqlhex} rw,
+  owner /var/tmp/etilqs_@{sqlhex} rw,
 
   @{run}/systemd/users/@{uid} r,
 

apparmor.d/profiles-a-f/fractal

@@ -34,7 +34,7 @@ profile fractal @{exec_path} flags=(attach_disconnected) {
   owner @{tmp}/.@{rand6} rw,
   owner @{tmp}/.goutputstream-@{rand6} rw,
   owner @{tmp}/@{rand6} rw,
-  owner @{tmp}/etilqs_@{hex16} rw,
+  owner @{tmp}/etilqs_@{sqlhex} rw,
 
   owner @{run}/user/@{uid}/fractal/{,**} rw,
 

apparmor.d/profiles-a-f/fwupd

@@ -67,7 +67,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) {
   @{lib}/fwupd/efi/fwupdx@{int}.efi{,.signed} r,
 
         /var/lib/flatpak/exports/share/mime/mime.cache r,
-        /var/tmp/etilqs_@{hex16} rw,
+        /var/tmp/etilqs_@{sqlhex} rw,
   owner /var/cache/fwupd/ rw,
   owner /var/cache/fwupd/** rwk,
   owner /var/lib/fwupd/ rw,

apparmor.d/profiles-g-l/gpo

@@ -36,7 +36,8 @@ profile gpo @{exec_path} {
   owner @{HOME}/gPodder/ rw,
   owner @{HOME}/gPodder/** rwk,
 
-  owner /var/tmp/etilqs_@{hex16} rw,
+  owner @{tmp}/etilqs_@{sqlhex} rw,
+  owner /var/tmp/etilqs_@{sqlhex} rw,
 
   owner @{PROC}/@{pid}/fd/ r,
 

apparmor.d/profiles-g-l/gpodder

@@ -47,7 +47,8 @@ profile gpodder @{exec_path} {
   owner @{HOME}/gPodder/ rw,
   owner @{HOME}/gPodder/** rwk,
 
-  owner /var/tmp/etilqs_@{hex16} rw,
+  owner @{tmp}/etilqs_@{sqlhex} rw,
+  owner /var/tmp/etilqs_@{sqlhex} rw,
 
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mounts r,

apparmor.d/profiles-m-r/protonmail-bridge-core

@@ -43,8 +43,8 @@ profile protonmail-bridge-core @{exec_path} flags=(attach_disconnected) {
   owner "@{user_config_dirs}/autostart/Proton Mail Bridge.desktop" rw,
 
   owner @{tmp}/bridge@{int} rw,
-  owner @{tmp}/etilqs_@{hex16} rw,
+  owner @{tmp}/etilqs_@{sqlhex} rw,
-  owner /var/tmp/etilqs_@{hex16} rw,
+  owner /var/tmp/etilqs_@{sqlhex} rw,
 
   @{PROC}/ r,
   @{PROC}/1/cgroup r,

apparmor.d/profiles-m-r/psi

@@ -54,7 +54,7 @@ profile psi @{exec_path} {
   owner @{user_share_dirs}/psi/** rwk,
 
   owner @{tmp}/#@{int} rw,
-  owner @{tmp}/etilqs_@{hex16} rw,
+  owner @{tmp}/etilqs_@{sqlhex} rw,
   owner @{tmp}/Psi.* rwl -> /tmp/#@{int},
 
   @{att}/@{run}/systemd/inhibit/@{int}.ref rw,

apparmor.d/profiles-m-r/psi-plus

@@ -54,7 +54,7 @@ profile psi-plus @{exec_path} {
   owner @{user_share_dirs}/psi+/** rwk,
 
   owner @{tmp}/#@{int} rw,
-  owner @{tmp}/etilqs_@{hex16} rw,
+  owner @{tmp}/etilqs_@{sqlhex} rw,
   owner @{tmp}/Psi+.* rwl -> /tmp/#@{int},
 
   @{att}/@{run}/systemd/inhibit/@{int}.ref rw,

apparmor.d/profiles-m-r/quiterss

@@ -47,7 +47,8 @@ profile quiterss @{exec_path} {
 
   owner @{tmp}/qtsingleapp-quiter-@{int}-@{int} rw,
   owner @{tmp}/qtsingleapp-quiter-@{int}-@{int}-lockfile rwk,
-  owner /var/tmp/etilqs_@{hex16} rw,
+  owner @{tmp}/etilqs_@{sqlhex} rw,
+  owner /var/tmp/etilqs_@{sqlhex} rw,
 
         @{PROC}/sys/kernel/random/boot_id r,
   owner @{PROC}/@{pid}/cmdline r,

apparmor.d/profiles-s-z/strawberry

@@ -68,7 +68,7 @@ profile strawberry @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   owner @{tmp}/.*/s rw,
   owner @{tmp}/*= w,
   owner @{tmp}/#@{int} rw,
-  owner @{tmp}/etilqs_@{hex16} rw,
+  owner @{tmp}/etilqs_@{sqlhex} rw,
   owner @{tmp}/kdsingleapp-daemonspudguy-strawberry w,
   owner @{tmp}/kdsingleapp-daemonspudguy-strawberry.lock rwk,
   owner @{tmp}/qipc_{systemsem,sharedmemory}_*[a-f0-9]* rw,

apparmor.d/profiles-s-z/wechat-appimage

@@ -59,11 +59,13 @@ profile wechat-appimage @{exec_path} flags=(attach_disconnected) {
   @{tmp}/.mount_wechat@{word6}/ rw,
   @{tmp}/.mount_wechat@{word6}/opt/wechat/{,**} mr,
 
-  owner /var/tmp/etilqs_* rw,
-
   @{HOME}/.xwechat/{,**} rwk,
+
   owner @{user_documents_dirs}/xwechat_files/{,**} rwk,
 
+  owner @{tmp}/etilqs_@{sqlhex} rw,
+  owner /var/tmp/etilqs_@{sqlhex} rw,
+
   /dev/fuse rw,
   /dev/tty rw,
 

apparmor.d/tunables/multiarch.d/system

@@ -54,6 +54,9 @@
 # System Internal
 # ---------------
 
+# SQlite temporary files (hexadecimal from 12 to 16 characters)
+@{sqlhex}=@{hex12} @{hex12}@{h} @{hex12}@{hex2} @{hex15} @{hex16}
+
 # Shortcut for PCI device
 @{pci_id}=@{h}@{h}@{h}@{h}:@{h}@{h}:@{h}@{h}.@{h}
 @{pci_bus}=pci@{h}@{h}@{h}@{h}:@{h}@{h}