From 3f37b6466860a73c1e006b5ed120fc521e612010 Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Wed, 6 Aug 2025 17:38:41 +0200
Subject: [PATCH] feat(profile): cleanup wechat profiles.

---
 apparmor.d/profiles-s-z/wechat           | 16 ++++++------
 apparmor.d/profiles-s-z/wechat-appimage  | 33 ++++++++++--------------
 apparmor.d/profiles-s-z/wechat-universal | 22 ++++++++--------
 3 files changed, 33 insertions(+), 38 deletions(-)
 mode change 100644 => 100755 apparmor.d/profiles-s-z/wechat-appimage

diff --git a/apparmor.d/profiles-s-z/wechat b/apparmor.d/profiles-s-z/wechat
index cb554fc6b..5764deb77 100644
--- a/apparmor.d/profiles-s-z/wechat
+++ b/apparmor.d/profiles-s-z/wechat
@@ -28,14 +28,14 @@ profile wechat @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
-  @{sh_path}  rix,
-  @{lib_dirs}/crashpad_handler ix,
-  @{bin}/mkdir ix,
-  @{bin}/{m,g,}awk rix,
-  @{bin}/lsblk rPx,
-  @{bin}/ip rix,
-  @{bin}/xdg-user-dir rix,
-  @{open_path} rpx -> child-open-strict,
+  @{sh_path}                                    rix,
+  @{bin}/{m,g,}awk                              rix,
+  @{bin}/ip                                     rix,
+  @{bin}/lsblk                                   Px,
+  @{bin}/mkdir                                  rix,
+  @{bin}/xdg-user-dir                           rix,
+  @{lib_dirs}/crashpad_handler                   ix,
+  @{open_path}                                   Px -> child-open-strict,
 
   owner @{HOME}/.xwechat/{,**} rwk,
   owner @{user_documents_dirs}/xwechat_files/{,**} rwk,
diff --git a/apparmor.d/profiles-s-z/wechat-appimage b/apparmor.d/profiles-s-z/wechat-appimage
old mode 100644
new mode 100755
index 9f8c20338..e7eabe6ec
--- a/apparmor.d/profiles-s-z/wechat-appimage
+++ b/apparmor.d/profiles-s-z/wechat-appimage
@@ -33,33 +33,28 @@ profile wechat-appimage @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} r,
 
-  @{sh_path}  rix,
-  @{lib_dirs}/wechat-appimage.AppImage ix,
-  /tmp/.mount_wechat??????/AppRun ix,
-  @{bin}/mkdir ix,
-  @{bin}/{m,g,}awk rix,
-  @{bin}/lsblk rPx,
-  @{bin}/ip rix,
-  @{bin}/xdg-user-dir rix,
-  @{tmp}/.mount_wechat@{word6}/opt/wechat/{,**} ix,
-  @{tmp}/.mount_wechat@{word6}/usr/bin/wechat ix,
-  @{open_path} rpx -> child-open-strict,
+  @{sh_path}                                    rix,
+  @{bin}/dirname                                rix,
+  @{bin}/fusermount{,3}                          Cx -> fusermount,
+  @{bin}/{m,g,}awk                              rix,
+  @{bin}/lsblk                                   Px,
+  @{bin}/mkdir                                  rix,
+  @{bin}/readlink                               rix,
+  @{bin}/xdg-user-dir                           rix,
+  @{bin}/ip                                     rix,
+  @{lib_dirs}/wechat-appimage.AppImage           ix,
+  @{open_path}                                   Px -> child-open-strict,
 
   @{bin}/fusermount{,3} Cx -> fusermount,
   @{bin}/dirname  rix,
   @{bin}/readlink rix,
 
-  @{bin}/ r,
-  @{bin}/*/ r,
-  /usr/local/bin/ r,
-  /usr/local/sbin/ r,
+  @{tmp}/.mount_wechat@{word6}/opt/wechat/{,**}  ix,
+  @{tmp}/.mount_wechat@{word6}/usr/bin/wechat    ix,
+  @{tmp}/.mount_wechat@{word6}/AppRun            ix,
 
   /etc/machine-id r,
 
-  @{tmp}/.mount_wechat@{word6}/AppRun r,
-  @{tmp}/.mount_wechat@{word6}/ rw,
-  @{tmp}/.mount_wechat@{word6}/opt/wechat/{,**} mr,
-
   @{HOME}/.xwechat/{,**} rwk,
 
   owner @{user_documents_dirs}/xwechat_files/{,**} rwk,
diff --git a/apparmor.d/profiles-s-z/wechat-universal b/apparmor.d/profiles-s-z/wechat-universal
index cd8958e8e..3824f9526 100644
--- a/apparmor.d/profiles-s-z/wechat-universal
+++ b/apparmor.d/profiles-s-z/wechat-universal
@@ -29,21 +29,21 @@ profile wechat-universal @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mrix,
 
-  @{sh_path}  rix,
-  @{lib}/wechat-universal/common.sh ix,
-  @{bin}/sed ix,
-  @{bin}/ln ix,
-  @{bin}/mkdir ix,
-  @{bin}/lsblk Px,
-  @{bin}/bwrap rix,
-  @{bin}/xdg-user-dir rix,
-  @{lib_dirs}/crashpad_handler ix,
-  @{open_path} rPx -> child-open-strict,
+  @{sh_path}                               rix,
+  @{bin}/bwrap                             rix,
+  @{bin}/ln                                 ix,
+  @{bin}/lsblk                              Px,
+  @{bin}/mkdir                              ix,
+  @{bin}/sed                                ix,
+  @{bin}/xdg-user-dir                      rix,
+  @{lib_dirs}/crashpad_handler              ix,
+  @{lib}/wechat-appimage.AppImage           ix,
+  @{open_path}                              Px -> child-open-strict,
 
   /etc/lsb-release r,
   /etc/machine-id r,
 
-  owner @{HOME}/@{XDG_DOCUMENTS_DIR}/WeChat_Data/{,**} rwk,
+  owner @{user_documents_dirs}/WeChat_Data/{,**} rwk,
   owner @{HOME}/.xwechat/{,**} rwk,
   owner @{HOME}/.sys1og.conf rw,