feat(abs): rewrite the avahi abs, add avahi-observe

apparmor.d/abstractions/app/chromium

@@ -25,10 +25,9 @@
   abi <abi/4.0>,
 
   include <abstractions/audio-client>
+  include <abstractions/avahi-observe>
   include <abstractions/bus-session>
   include <abstractions/bus-system>
-  include <abstractions/bus/system/org.bluez>
-  include <abstractions/bus/org.freedesktop.Avahi>
   include <abstractions/bus/org.freedesktop.FileManager1>
   include <abstractions/bus/org.gnome.Mutter.IdleMonitor>
   include <abstractions/bus/org.gnome.SessionManager>

apparmor.d/abstractions/avahi-observe

@@ -0,0 +1,25 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2016 Canonical Ltd
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Allows domain, record, service, and service type browsing as well as address,
+# host and service resolving
+
+  abi <abi/4.0>,
+
+  include <abstractions/bus/system/org.freedesktop.Avahi.Server>
+
+  include <abstractions/bus/system/org.freedesktop.Avahi.AddressResolver>
+  include <abstractions/bus/system/org.freedesktop.Avahi.DomainBrowser>
+  include <abstractions/bus/system/org.freedesktop.Avahi.HostNameResolver>
+  include <abstractions/bus/system/org.freedesktop.Avahi.RecordBrowser>
+  include <abstractions/bus/system/org.freedesktop.Avahi.ServiceBrowser>
+  include <abstractions/bus/system/org.freedesktop.Avahi.ServiceResolver>
+  include <abstractions/bus/system/org.freedesktop.Avahi.ServiceTypeBrowser>
+
+  @{run}/avahi-daemon/socket rw,
+
+  include if exists <abstractions/avahi-observe.d>
+
+# vim:syntax=apparmor

apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.AddressResolver

@@ -0,0 +1,25 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Address resolving
+
+  abi <abi/4.0>,
+
+  dbus send bus=system path=/
+       interface=org.freedesktop.Avahi.Server
+       member=AddressResolverNew
+       peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
+
+  dbus send bus=system path=/Client@{int}/AddressResolver@{int}
+       interface=org.freedesktop.Avahi.AddressResolver
+       member=Free
+       peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
+
+  dbus receive bus=system path=/Client@{int}/AddressResolver@{int}
+       interface=org.freedesktop.Avahi.AddressResolver
+       peer=(name=@{busname}, label="@{p_avahi_daemon}"),
+
+  include if exists <abstractions/bus/system/org.freedesktop.Avahi.AddressResolver.d>
+
+# vim:syntax=apparmor

apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.DomainBrowser

@@ -0,0 +1,25 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Domain browsing
+
+  abi <abi/4.0>,
+
+  dbus send bus=system path=/
+       interface=org.freedesktop.Avahi.Server
+       member=DomainBrowserNew
+       peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
+
+  dbus send bus=system path=/Client@{int}/DomainBrowser@{int}
+       interface=org.freedesktop.Avahi.DomainBrowser
+       member=Free
+       peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
+
+  dbus receive bus=system path=/Client@{int}/DomainBrowser@{int}
+       interface=org.freedesktop.Avahi.DomainBrowser
+       peer=(name=@{busname}, label="@{p_avahi_daemon}"),
+
+  include if exists <abstractions/bus/system/org.freedesktop.Avahi.DomainBrowser.d>
+
+# vim:syntax=apparmor

apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.HostNameResolver

@@ -0,0 +1,25 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Hostname resolving
+
+  abi <abi/4.0>,
+
+  dbus send bus=system path=/
+       interface=org.freedesktop.Avahi.Server
+       member=HostNameResolverNew
+       peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
+
+  dbus send bus=system path=/Client@{int}/HostNameResolver@{int}
+       interface=org.freedesktop.Avahi.HostNameResolver
+       member=Free
+       peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
+
+  dbus receive bus=system path=/Client@{int}/HostNameResolver@{int}
+       interface=org.freedesktop.Avahi.HostNameResolver
+       peer=(name=@{busname}, label="@{p_avahi_daemon}"),
+
+  include if exists <abstractions/bus/system/org.freedesktop.Avahi.HostNameResolver.d>
+
+# vim:syntax=apparmor

apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.RecordBrowser

@@ -0,0 +1,25 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Record browsing
+
+  abi <abi/4.0>,
+
+  dbus send bus=system path=/
+       interface=org.freedesktop.Avahi.Server
+       member=RecordBrowserNew
+       peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
+
+  dbus send bus=system path=/Client@{int}/RecordBrowser@{int}
+       interface=org.freedesktop.Avahi.RecordBrowser
+       member=Free
+       peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
+
+  dbus receive bus=system path=/Client@{int}/RecordBrowser@{int}
+       interface=org.freedesktop.Avahi.RecordBrowser
+       peer=(name=@{busname}, label="@{p_avahi_daemon}"),
+
+  include if exists <abstractions/bus/system/org.freedesktop.Avahi.RecordBrowser.d>
+
+# vim:syntax=apparmor

apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.Server

@@ -0,0 +1,31 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+  abi <abi/4.0>,
+
+  dbus send bus=system path=/
+       interface=org.freedesktop.DBus.Peer
+       member=Ping
+       peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
+
+  # Allow service introspection
+  dbus send bus=system path=/
+       interface=org.freedesktop.DBus.Introspectable
+       member=Introspect
+       peer=(name=@{busname}, label="@{p_avahi_daemon}"),
+
+  # Allow accessing DBus properties and resolving
+  dbus send bus=system path=/
+       interface=org.freedesktop.Avahi.Server
+       member={Get*,Resolve*,IsNSSSupportAvailable}
+       peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
+
+  # Allow receiving anything from the Avahi server
+  dbus receive bus=system
+       interface=org.freedesktop.Avahi.Server
+       peer=(name=@{busname},  label="@{p_avahi_daemon}"),
+
+  include if exists <abstractions/bus/system/org.freedesktop.Avahi.Server.d>
+
+# vim:syntax=apparmor

apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.ServiceBrowser

@@ -0,0 +1,23 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+  abi <abi/4.0>,
+
+  dbus send bus=system path=/
+       interface=org.freedesktop.Avahi.Server
+       member=ServiceBrowserNew
+       peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
+
+  dbus send bus=system path=/Client@{int}/ServiceBrowser@{int}
+       interface=org.freedesktop.Avahi.ServiceBrowser
+       member=Free
+       peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
+
+  dbus receive bus=system path=/Client@{int}/ServiceBrowser@{int}
+       interface=org.freedesktop.Avahi.ServiceBrowser
+       peer=(name=@{busname}, label="@{p_avahi_daemon}"),
+
+  include if exists <abstractions/bus/system/org.freedesktop.Avahi.ServiceBrowser.d>
+
+# vim:syntax=apparmor

apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.ServiceResolver

@@ -0,0 +1,25 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Service resolving
+
+  abi <abi/4.0>,
+
+  dbus send bus=system path=/
+       interface=org.freedesktop.Avahi.Server
+       member=ServiceResolverNew
+       peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
+
+  dbus send bus=system path=/Client@{int}/ServiceResolver@{int}
+       interface=org.freedesktop.Avahi.ServiceResolver
+       member=Free
+       peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
+
+  dbus receive bus=system path=/Client@{int}/ServiceResolver@{int}
+       interface=org.freedesktop.Avahi.ServiceResolver
+       peer=(name=@{busname}, label="@{p_avahi_daemon}"),
+
+  include if exists <abstractions/bus/system/org.freedesktop.Avahi.ServiceResolver.d>
+
+# vim:syntax=apparmor

apparmor.d/abstractions/bus/system/org.freedesktop.Avahi.ServiceTypeBrowser

@@ -0,0 +1,25 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Service type browsing
+
+  abi <abi/4.0>,
+
+  dbus send bus=system path=/
+       interface=org.freedesktop.Avahi.Server
+       member=ServiceTypeBrowserNew
+       peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
+
+  dbus send bus=system path=/Client@{int}/ServiceTypeBrowser@{int}
+       interface=org.freedesktop.Avahi.ServiceTypeBrowser
+       member=Free
+       peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
+
+  dbus receive bus=system path=/Client@{int}/ServiceTypeBrowser@{int}
+       interface=org.freedesktop.Avahi.ServiceTypeBrowser
+       peer=(name=@{busname}, label="@{p_avahi_daemon}"),
+
+  include if exists <abstractions/bus/system/org.freedesktop.Avahi.ServiceTypeBrowser.d>
+
+# vim:syntax=apparmor

apparmor.d/abstractions/common/app

@@ -13,6 +13,7 @@
   abi <abi/4.0>,
 
   include <abstractions/audio-client>
+  include <abstractions/avahi-observe>
   include <abstractions/bus-accessibility>
   include <abstractions/bus-session>
   include <abstractions/bus-system>
@@ -73,7 +74,6 @@
 
   @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
 
-  @{run}/avahi-daemon/socket rw, # Allow access to avahi-daemon socket.
   @{run}/host/{,**} r,
   @{run}/pcscd/pcscd.comm rw, # Allow access to pcscd socket.
   @{run}/utmp rk,

apparmor.d/groups/avahi/avahi-browse

@@ -11,14 +11,10 @@ include <tunables/global>
 profile avahi-browse @{exec_path} {
   include <abstractions/base>
   include <abstractions/bus-system>
-  include <abstractions/bus/org.freedesktop.Avahi>
+  include <abstractions/bus/system/org.freedesktop.Avahi.Server>
+  include <abstractions/bus/system/org.freedesktop.Avahi.ServiceTypeBrowser>
   include <abstractions/consoles>
 
-  dbus receive bus=system path=/Client@{int}/ServiceTypeBrowser@{int}
-       interface=org.freedesktop.Avahi.ServiceTypeBrowser
-       member={ItemNew,AllForNow,CacheExhausted}
-       peer=(name=:*, label="@{p_avahi_daemon}"),
-
   @{exec_path} mr,
 
   @{lib}/@{multiarch}/avahi/service-types.db rwk,

apparmor.d/groups/avahi/avahi-resolve

@@ -11,19 +11,11 @@ include <tunables/global>
 profile avahi-resolve @{exec_path} {
   include <abstractions/base>
   include <abstractions/bus-system>
-  include <abstractions/bus/org.freedesktop.Avahi>
+  include <abstractions/bus/system/org.freedesktop.Avahi.AddressResolver>
+  include <abstractions/bus/system/org.freedesktop.Avahi.HostNameResolver>
+  include <abstractions/bus/system/org.freedesktop.Avahi.Server>
   include <abstractions/consoles>
 
-  dbus send bus=system path=/Client@{int}/AddressResolver@{int}
-       interface=org.freedesktop.Avahi.AddressResolver
-       member={Free,HostNameResolverNew}
-       peer=(name=:*, label="@{p_avahi_daemon}"),
-
-  dbus receive bus=system path=/Client@{int}/AddressResolver@{int}
-       interface=org.freedesktop.Avahi.AddressResolver
-       member={Failure,Found}
-       peer=(name=:*, label="@{p_avahi_daemon}"),
-
   @{exec_path} mr,
 
   include if exists <local/avahi-resolve>

apparmor.d/groups/avahi/avahi-set-host-name

@@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2022 Jeroen Rijken
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/4.0>,
@@ -9,6 +10,8 @@ include <tunables/global>
 @{exec_path} = @{bin}/avahi-set-host-name
 profile avahi-set-host-name @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus/system/org.freedesktop.Avahi.HostNameResolver>
+  include <abstractions/bus/system/org.freedesktop.Avahi.Server>
   include <abstractions/consoles>
 
   @{exec_path} mr,

apparmor.d/groups/cups/cups-backend-dnssd

@@ -9,7 +9,7 @@ include <tunables/global>
 @{exec_path} = @{lib}/cups/backend/dnssd
 profile cups-backend-dnssd @{exec_path} {
   include <abstractions/base>
-  include <abstractions/bus/org.freedesktop.Avahi>
+  include <abstractions/bus/system/org.freedesktop.Avahi.Server>
 
   @{exec_path} mr,
 

apparmor.d/groups/cups/cups-browsed

@@ -10,8 +10,10 @@ include <tunables/global>
 profile cups-browsed @{exec_path} {
   include <abstractions/base>
   include <abstractions/bus-system>
-  include <abstractions/bus/org.freedesktop.Avahi>
   include <abstractions/bus/org.freedesktop.NetworkManager>
+  include <abstractions/bus/system/org.freedesktop.Avahi.RecordBrowser>
+  include <abstractions/bus/system/org.freedesktop.Avahi.Server>
+  include <abstractions/bus/system/org.freedesktop.Avahi.ServiceBrowser>
   include <abstractions/cups-client>
   include <abstractions/nameservice-strict>
   include <abstractions/p11-kit>

apparmor.d/groups/cups/cupsd

@@ -11,7 +11,7 @@ profile cupsd @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/authentication>
   include <abstractions/bus-system>
-  include <abstractions/bus/org.freedesktop.Avahi>
+  include <abstractions/bus/system/org.freedesktop.Avahi.Server>
   include <abstractions/bus/system/org.freedesktop.ColorManager>
   include <abstractions/nameservice-strict>
   include <abstractions/python>

apparmor.d/groups/cups/ippfind

@@ -10,7 +10,7 @@ include <tunables/global>
 profile ippfind @{exec_path} {
   include <abstractions/base>
   include <abstractions/bus-system>
-  include <abstractions/bus/org.freedesktop.Avahi>
+  include <abstractions/bus/system/org.freedesktop.Avahi.Server>
 
   @{exec_path} mr,
 

apparmor.d/groups/freedesktop/colord

@@ -11,8 +11,9 @@ include <tunables/global>
 profile colord @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus-system>
-  include <abstractions/bus/org.freedesktop.Avahi>
   include <abstractions/bus/org.freedesktop.PolicyKit1>
+  include <abstractions/bus/system/org.freedesktop.Avahi.Server>
+  include <abstractions/bus/system/org.freedesktop.Avahi.ServiceBrowser>
   include <abstractions/devices-usb>
   include <abstractions/mime>
   include <abstractions/nameservice-strict>

apparmor.d/groups/freedesktop/geoclue

@@ -11,9 +11,10 @@ profile geoclue @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus-system>
   include <abstractions/bus/fi.w1.wpa_supplicant1>
-  include <abstractions/bus/org.freedesktop.Avahi>
   include <abstractions/bus/org.freedesktop.ModemManager1>
   include <abstractions/bus/org.freedesktop.NetworkManager>
+  include <abstractions/bus/system/org.freedesktop.Avahi.Server>
+  include <abstractions/bus/system/org.freedesktop.Avahi.ServiceBrowser>
   include <abstractions/consoles>
   include <abstractions/gschemas>
   include <abstractions/nameservice-strict>

apparmor.d/groups/freedesktop/pulseaudio

@@ -14,10 +14,12 @@ profile pulseaudio @{exec_path} {
   include <abstractions/audio-server>
   include <abstractions/bus-session>
   include <abstractions/bus-system>
-  include <abstractions/bus/org.bluez>
-  include <abstractions/bus/org.freedesktop.Avahi>
   include <abstractions/bus/org.freedesktop.hostname1>
   include <abstractions/bus/org.freedesktop.RealtimeKit1>
+  include <abstractions/bus/org.bluez>
+  include <abstractions/bus/system/org.freedesktop.Avahi.Server>
+  include <abstractions/bus/system/org.freedesktop.Avahi.ServiceBrowser>
+  include <abstractions/bus/system/org.freedesktop.Avahi.ServiceResolver>
   include <abstractions/camera>
   include <abstractions/consoles>
   include <abstractions/dconf-write>
@@ -49,26 +51,11 @@ profile pulseaudio @{exec_path} {
        member=Introspect
        peer=(name=:*, label=gnome-shell),
 
-  dbus receive bus=system path=/Client@{int}/ServiceResolver@{int}
-       interface=org.freedesktop.Avahi.ServiceResolver
-       member=Found
-       peer=(name=:*, label="@{p_avahi_daemon}"),
-
-  dbus receive bus=system path=/Client@{int}/ServiceBrowser@{int}
-       interface=org.freedesktop.Avahi.ServiceBrowser
-       member=ItemRemove
-       peer=(name=:*, label="@{p_avahi_daemon}"),
-
   dbus send bus=system path=/
        interface=org.freedesktop.DBus.ObjectManager
        member=GetManagedObjects
        peer=(name=org.bluez),
 
-  dbus send bus=system path=/Client@{int}/ServiceResolver@{int}
-       interface=org.freedesktop.Avahi.ServiceResolver
-       member={Found,Free}
-       peer=(name=org.freedesktop.Avahi, label="@{p_avahi_daemon}"),
-
   @{exec_path} mrix,
 
   @{lib}/pulse/gsettings-helper rix,

apparmor.d/groups/freedesktop/xdg-dbus-proxy

@@ -14,7 +14,7 @@ profile xdg-dbus-proxy @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus-session>
   include <abstractions/bus-system>
   include <abstractions/bus/org.a11y>
-  include <abstractions/bus/org.freedesktop.Avahi>
+  include <abstractions/bus/system/org.freedesktop.Avahi.Server>
   include <abstractions/bus/org.freedesktop.NetworkManager>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
   include <abstractions/user-download-strict>

apparmor.d/groups/gnome/gnome-control-center

@@ -10,11 +10,11 @@ include <tunables/global>
 profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/audio-client>
+  include <abstractions/avahi-observe>
   include <abstractions/bus-accessibility>
   include <abstractions/bus-session>
   include <abstractions/bus-system>
   include <abstractions/bus/org.a11y>
-  include <abstractions/bus/org.freedesktop.Avahi>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
   include <abstractions/bus/org.gtk.vfs.MountTracker>
   include <abstractions/camera>

apparmor.d/groups/gnome/gnome-control-center-goa-helper

@@ -9,11 +9,11 @@ include <tunables/global>
 @{exec_path} = @{lib}/gnome-control-center-goa-helper
 profile gnome-control-center-goa-helper @{exec_path} {
   include <abstractions/base>
+  include <abstractions/avahi-observe>
   include <abstractions/bus-accessibility>
   include <abstractions/bus-session>
   include <abstractions/bus-system>
   include <abstractions/bus/org.a11y>
-  include <abstractions/bus/org.freedesktop.Avahi>
   include <abstractions/bus/org.gtk.vfs.MountTracker>
   include <abstractions/dconf-write>
   include <abstractions/gnome-strict>

apparmor.d/groups/gnome/gsd-print-notifications

@@ -9,11 +9,14 @@ include <tunables/global>
 @{exec_path} = @{lib}/gsd-print-notifications
 profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
-  include <abstractions/consoles>
   include <abstractions/bus-session>
   include <abstractions/bus-system>
-  include <abstractions/bus/org.freedesktop.Avahi>
   include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
+  include <abstractions/bus/system/org.freedesktop.Avahi.RecordBrowser>
+  include <abstractions/bus/system/org.freedesktop.Avahi.Server>
+  include <abstractions/bus/system/org.freedesktop.Avahi.ServiceBrowser>
+  include <abstractions/consoles>
   include <abstractions/cups-client>
   include <abstractions/nameservice-strict>
 
@@ -38,24 +41,6 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) {
        member=Introspect
        peer=(name=@{busname}, label=gnome-shell),
 
-  dbus send bus=system path=/
-       interface=org.freedesktop.Avahi.Server
-       member=RecordBrowserNew
-       peer=(name=org.freedesktop.Avahi, label=avahi-daemon),
-  dbus send bus=system path=/Client@{int}/RecordBrowser@{int}
-       interface=org.freedesktop.Avahi.RecordBrowser
-       member=Free
-       peer=(name=org.freedesktop.Avahi, label=avahi-daemon),
-
-  dbus receive bus=system path=/Client@{int}/RecordBrowser@{int}
-       interface=org.freedesktop.Avahi.RecordBrowser
-       member={CacheExhausted,ItemNew}
-       peer=(name=@{busname}, label=avahi-daemon),
-  dbus receive bus=system path=/Client4/RecordBrowser3
-       interface=org.freedesktop.Avahi.RecordBrowser
-       member=ItemNew
-       peer=(name=@{busname}, label=avahi-daemon),
-
   @{exec_path} mr,
   @{lib}/gsd-printer rPx,
 

apparmor.d/groups/gnome/seahorse

@@ -9,11 +9,11 @@ include <tunables/global>
 @{exec_path} = @{bin}/seahorse
 profile seahorse @{exec_path} {
   include <abstractions/base>
+  include <abstractions/avahi-observe>
   include <abstractions/bus-accessibility>
   include <abstractions/bus-session>
   include <abstractions/bus-system>
   include <abstractions/bus/org.a11y>
-  include <abstractions/bus/org.freedesktop.Avahi>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
   include <abstractions/bus/org.gtk.vfs.MountTracker>
   include <abstractions/dconf-write>

apparmor.d/groups/gvfs/gvfsd-dnssd

@@ -12,9 +12,10 @@ profile gvfsd-dnssd @{exec_path} {
   include <abstractions/base>
   include <abstractions/bus-session>
   include <abstractions/bus-system>
-  include <abstractions/bus/org.freedesktop.Avahi>
   include <abstractions/bus/org.gtk.vfs.Daemon>
   include <abstractions/bus/org.gtk.vfs.MountTracker>
+  include <abstractions/bus/system/org.freedesktop.Avahi.Server>
+  include <abstractions/bus/system/org.freedesktop.Avahi.ServiceBrowser>
 
   #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_dnssd
 

apparmor.d/profiles-g-l/libreoffice

@@ -11,11 +11,11 @@ include <tunables/global>
 profile libreoffice @{exec_path} {
   include <abstractions/base>
   include <abstractions/audio-client>
+  include <abstractions/avahi-observe>
   include <abstractions/bus-accessibility>
   include <abstractions/bus-session>
   include <abstractions/bus-system>
   include <abstractions/bus/org.a11y>
-  include <abstractions/bus/org.freedesktop.Avahi>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
   include <abstractions/bus/org.gnome.SessionManager>
   include <abstractions/bus/org.gtk.Private.RemoteVolumeMonitor>

apparmor.d/profiles-m-r/murmurd

@@ -10,7 +10,7 @@ include <tunables/global>
 profile murmurd @{exec_path} {
   include <abstractions/base>
   include <abstractions/bus-system>
-  include <abstractions/bus/org.freedesktop.Avahi>
+  include <abstractions/bus/system/org.freedesktop.Avahi.Server>
   include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
 

apparmor.d/profiles-m-r/remmina

@@ -10,11 +10,11 @@ include <tunables/global>
 profile remmina @{exec_path} {
   include <abstractions/base>
   include <abstractions/audio-client>
+  include <abstractions/avahi-observe>
   include <abstractions/bus-accessibility>
   include <abstractions/bus-session>
   include <abstractions/bus-system>
   include <abstractions/bus/org.a11y>
-  include <abstractions/bus/org.freedesktop.Avahi>
   include <abstractions/bus/org.freedesktop.hostname1>
   include <abstractions/bus/org.gtk.Private.RemoteVolumeMonitor>
   include <abstractions/bus/org.kde.StatusNotifierWatcher>