feat(profile): use the new @{tmp} variable.

It is only used with the owner statement.

apparmor.d/profiles-a-f/aa-notify

@@ -33,8 +33,8 @@ profile aa-notify @{exec_path} {
   owner @{HOME}/.inputrc r,
   owner @{HOME}/.terminfo/@{int}/dumb r,
 
-  owner /tmp/@{rand8} rw,
-  owner /tmp/apparmor-bugreport-*.txt rw,
+  owner @{tmp}/@{rand8} rw,
+  owner @{tmp}/apparmor-bugreport-*.txt rw,
 
   @{PROC}/ r,
   @{PROC}/@{pid}/stat r,

apparmor.d/profiles-a-f/adb

@@ -24,7 +24,7 @@ profile adb @{exec_path} {
 
   /usr/share/scrcpy/scrcpy-server r,
 
-  owner /tmp/adb.@{int}.log rw,
+  owner @{tmp}/adb.@{int}.log rw,
 
   owner @{HOME}/.android/ rw,
   owner @{HOME}/.android/adb.@{int} rw,

apparmor.d/profiles-a-f/anacron

@@ -35,8 +35,8 @@ profile anacron @{exec_path} {
     /etc/cron.*/     r,
     /etc/cron.*/* rPUx,
 
-    owner /tmp/#@{int} rw,
-    owner /tmp/file@{rand6} rw,
+    owner @{tmp}/#@{int} rw,
+    owner @{tmp}/file@{rand6} rw,
 
    include if exists <local/anacron_run_parts>
   }

apparmor.d/profiles-a-f/anyremote

@@ -61,8 +61,8 @@ profile anyremote @{exec_path} {
   @{bin}/mpv             rPx,
   @{bin}/strawberry      rPx,
 
-  owner /tmp/amarok_covers/ rw,
-  owner /tmp/*.png rw,
+  owner @{tmp}/amarok_covers/ rw,
+  owner @{tmp}/*.png rw,
 
   # For shell pwd
   owner @{HOME}/ r,
@@ -92,9 +92,9 @@ profile anyremote @{exec_path} {
     owner @{HOME}/.kde/share/apps/amarok/albumcovers/cache/* r,
 
           /tmp/ r,
-    owner /tmp/*.png rw,
-    owner /tmp/amarok_covers/* rw,
-    owner /tmp/magick-* rw,
+    owner @{tmp}/*.png rw,
+    owner @{tmp}/amarok_covers/* rw,
+    owner @{tmp}/magick-* rw,
 
   }
 

apparmor.d/profiles-a-f/apparmor_parser

@@ -36,7 +36,7 @@ profile apparmor_parser @{exec_path} flags=(attach_disconnected) {
   owner /var/lib/snapd/apparmor/{,**} r,
   owner /var/snap/lxd/common/lxd/security/apparmor/{,**} rw,
 
-  owner /tmp/cri-containerd.apparmor.d@{int} r,
+  owner @{tmp}/cri-containerd.apparmor.d@{int} r,
 
         @{sys}/kernel/security/apparmor/{,**} r,
   owner @{sys}/kernel/security/apparmor/.{remove,replace,load,access} rw,

apparmor.d/profiles-a-f/appstreamcli

@@ -52,9 +52,9 @@ profile appstreamcli @{exec_path} flags=(complain) {
   owner @{user_cache_dirs}/appstream/ rw,
   owner @{user_cache_dirs}/appstream/appcache-*.mdb rw,
 
-  owner /tmp/appstream-cache-*.mdb rw,
-  owner /tmp/appstream/ rw,
-  owner /tmp/appstream/appcache-*.mdb rw,
+  owner @{tmp}/appstream-cache-*.mdb rw,
+  owner @{tmp}/appstream/ rw,
+  owner @{tmp}/appstream/appcache-*.mdb rw,
 
   owner @{PROC}/@{pid}/fd/ r,
 

apparmor.d/profiles-a-f/arduino

@@ -67,18 +67,18 @@ profile arduino @{exec_path} {
   owner @{HOME}/.Xauthority r,
 
         /tmp/ r,
-  owner /tmp/cc*.{s,res,c,o,ld,le} rw,
-  owner /tmp/hsperfdata_*/ rw,
-  owner /tmp/hsperfdata_*/@{pid} rw,
-  owner /tmp/untitled[0-9]*.tmp rw,
-  owner /tmp/untitled[0-9]*.tmp/{,**} rw,
-  owner /tmp/console[0-9]*.tmp rw,
-  owner /tmp/console[0-9]*.tmp/{,**} rw,
-  owner /tmp/build[0-9]*.tmp rw,
-  owner /tmp/build[0-9]*.tmp/{,**} rw,
-  owner /tmp/arduino_{build,cache}_[0-9]*/{,**} rw,
-  owner /tmp/{library,package}_index.json*.tmp* rw,
-  owner /tmp/arduino_modified_sketch_[0-9]*/{,**} rw,
+  owner @{tmp}/cc*.{s,res,c,o,ld,le} rw,
+  owner @{tmp}/hsperfdata_*/ rw,
+  owner @{tmp}/hsperfdata_*/@{pid} rw,
+  owner @{tmp}/untitled[0-9]*.tmp rw,
+  owner @{tmp}/untitled[0-9]*.tmp/{,**} rw,
+  owner @{tmp}/console[0-9]*.tmp rw,
+  owner @{tmp}/console[0-9]*.tmp/{,**} rw,
+  owner @{tmp}/build[0-9]*.tmp rw,
+  owner @{tmp}/build[0-9]*.tmp/{,**} rw,
+  owner @{tmp}/arduino_{build,cache}_[0-9]*/{,**} rw,
+  owner @{tmp}/{library,package}_index.json*.tmp* rw,
+  owner @{tmp}/arduino_modified_sketch_[0-9]*/{,**} rw,
 
   owner @{run}/lock/tmp* rw,
   owner @{run}/lock/LCK..ttyS[0-9]* rw,

apparmor.d/profiles-a-f/arduino-builder

@@ -42,10 +42,10 @@ profile arduino-builder @{exec_path} {
   @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
 
         /tmp/ r,
-  owner /tmp/cc* rw,
-  owner /tmp/untitled[0-9]*.tmp/{,**} rw,
-  owner /tmp/arduino_{build,cache}_[0-9]*/{,**} rw,
-  owner /tmp/arduino_modified_sketch_[0-9]*/{,**} rw,
+  owner @{tmp}/cc* rw,
+  owner @{tmp}/untitled[0-9]*.tmp/{,**} rw,
+  owner @{tmp}/arduino_{build,cache}_[0-9]*/{,**} rw,
+  owner @{tmp}/arduino_modified_sketch_[0-9]*/{,**} rw,
 
   include if exists <local/arduino-builder>
 }

apparmor.d/profiles-a-f/arduino-ctags

@@ -13,9 +13,9 @@ profile arduino-ctags @{exec_path} {
 
   @{exec_path} mr,
 
-  owner /tmp/tags.* rw,
+  owner @{tmp}/tags.* rw,
 
-  owner /tmp/arduino_build_@{int}/** r,
+  owner @{tmp}/arduino_build_@{int}/** r,
 
   include if exists <local/arduino-ctags>
 }

apparmor.d/profiles-a-f/atril

@@ -60,10 +60,10 @@ profile atril @{exec_path} {
 
   owner @{user_share_dirs}/ r,
 
-  owner /tmp/gtkprint_* rw,
-  owner /tmp/settings*.ini rw,
-  owner /tmp/settings*.ini.* rw,
-  owner /tmp/atril-@{pid}/{,**} rw,
+  owner @{tmp}/gtkprint_* rw,
+  owner @{tmp}/settings*.ini rw,
+  owner @{tmp}/settings*.ini.* rw,
+  owner @{tmp}/atril-@{pid}/{,**} rw,
 
   @{sys}/firmware/acpi/pm_profile r,
   @{sys}/devices/virtual/dmi/id/chassis_type r,

apparmor.d/profiles-a-f/augenrules

@@ -28,7 +28,7 @@ profile augenrules @{exec_path} flags=(attach_disconnected) {
   /etc/audit/audit.rules rw,
   /etc/audit/rules.d/{,*} r,
 
-  owner /tmp/aurules.@{rand8} rw,
+  owner @{tmp}/aurules.@{rand8} rw,
 
   /dev/tty rw,
 

apparmor.d/profiles-a-f/birdtray

@@ -41,7 +41,7 @@ profile birdtray @{exec_path} {
   owner @{user_config_dirs}/birdtray-config.json rwl -> @{user_config_dirs}/#@{int},
   owner @{user_config_dirs}/birdtray-config.json.* rwl -> @{user_config_dirs}/#@{int},
 
-  owner /tmp/birdtray.ulduzsoft.single.instance.server.socket w,
+  owner @{tmp}/birdtray.ulduzsoft.single.instance.server.socket w,
 
   # Thunderbird mail dirs
   owner @{HOME}/ r,

apparmor.d/profiles-a-f/borg

@@ -64,12 +64,12 @@ profile borg @{exec_path} {
   owner @{user_config_dirs}/borg/** rw,
 
   # If /tmp/ isn't accessible, then /var/tmp/ is used.
-  owner /tmp/* rw,
-  owner /tmp/borg-cache-*/ rw,
-  owner /tmp/borg-cache-*/* rw,
-  owner /tmp/tmp*/ rw,
-  owner /tmp/tmp*/file rw,
-  owner /tmp/tmp*/idx rw,
+  owner @{tmp}/* rw,
+  owner @{tmp}/borg-cache-*/ rw,
+  owner @{tmp}/borg-cache-*/* rw,
+  owner @{tmp}/tmp*/ rw,
+  owner @{tmp}/tmp*/file rw,
+  owner @{tmp}/tmp*/idx rw,
   owner /var/lib/libuuid/clock.txt w,
   owner /var/tmp/* rw,
   owner /var/tmp/tmp*/ rw,

apparmor.d/profiles-a-f/browserpass

@@ -23,7 +23,7 @@ profile browserpass @{exec_path} flags=(attach_disconnected) {
   owner @{user_cache_dirs}/mozilla/firefox/@{rand8}.*/startupCache/scriptCache-*.bin r,
   owner @{user_cache_dirs}/mozilla/firefox/@{rand8}.*/startupCache/startupCache.*.little r,
   owner @{user_cache_dirs}/mozilla/firefox/@{rand8}.*/safebrowsing-updating/google[0-9]/goog-phish-proto-@{int}.vlpset rw,
-  owner /tmp/mozilla-temp-@{int} r,
+  owner @{tmp}/mozilla-temp-@{int} r,
 
   @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
 

apparmor.d/profiles-a-f/btrfs

@@ -37,7 +37,7 @@ profile btrfs @{exec_path} flags=(attach_disconnected) {
   owner @{user_img_dirs}/{,**} rwk,
 
   # For fsck of the btrfs filesystem directly from gparted
-  owner /tmp/gparted-*/ rw,
+  owner @{tmp}/gparted-*/ rw,
 
   @{run}/blkid/blkid.tab{,-@{rand6}} rw,
   @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,

apparmor.d/profiles-a-f/check-support-status

@@ -55,7 +55,7 @@ profile check-support-status @{exec_path} {
   owner @{HOME}/ r,
 
         /tmp/ r,
-  owner /tmp/debian-security-support.*/{,**} rw,
+  owner @{tmp}/debian-security-support.*/{,**} rw,
         /tmp/debian-security-support.postinst.*/output w,
 
         /var/lib/debian-security-support/ r,
@@ -73,7 +73,7 @@ profile check-support-status @{exec_path} {
     @{bin}/debconf-escape r,
     @{bin}/perl r,
 
-    owner /tmp/debian-security-support.postinst.*/output r,
+    owner @{tmp}/debian-security-support.postinst.*/output r,
 
   }
 

apparmor.d/profiles-a-f/check-support-status-hook

@@ -40,8 +40,8 @@ profile check-support-status-hook @{exec_path} {
   /root/ r,
 
         /tmp/ r,
-  owner /tmp/debian-security-support.postinst.*/ rw,
-  owner /tmp/debian-security-support.postinst.*/output rw,
+  owner @{tmp}/debian-security-support.postinst.*/ rw,
+  owner @{tmp}/debian-security-support.postinst.*/output rw,
 
   /var/lib/ r,
   /var/lib/debian-security-support/ r,
@@ -56,7 +56,7 @@ profile check-support-status-hook @{exec_path} {
     @{bin}/perl r,
 
           /tmp/ r,
-    owner /tmp/debian-security-support.postinst.*/output r,
+    owner @{tmp}/debian-security-support.postinst.*/output r,
 
   }
 
@@ -123,7 +123,7 @@ profile check-support-status-hook @{exec_path} {
     @{etc_ro}/security/limits.d/ r,
 
           /tmp/ r,
-    owner /tmp/debian-security-support.postinst.*/output w,
+    owner @{tmp}/debian-security-support.postinst.*/output w,
   }
 
   include if exists <local/check-support-status-hook>

apparmor.d/profiles-a-f/claws-mail

@@ -48,9 +48,9 @@ profile claws-mail @{exec_path} flags=(complain) {
   owner @{user_mail_dirs}/ rw,
   owner @{user_mail_dirs}/** rwl -> @{user_mail_dirs}/**,
 
-  owner /tmp/claws-mail-@{int}/ rw,
-  owner /tmp/claws-mail-@{int}/@{hex} rw,
-  owner /tmp/claws-mail-@{int}/@{hex}.lock rwk,
+  owner @{tmp}/claws-mail-@{int}/ rw,
+  owner @{tmp}/claws-mail-@{int}/@{hex} rw,
+  owner @{tmp}/claws-mail-@{int}/@{hex}.lock rwk,
 
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mountinfo r,

apparmor.d/profiles-a-f/code

@@ -65,9 +65,9 @@ profile code flags=(attach_disconnected) {
   owner @{user_projects_dirs}/ r,
   owner @{user_projects_dirs}/** rwkl -> @{user_projects_dirs}/**,
 
-  owner /tmp/@{uuid} rw,
-  owner /tmp/vscode-*/{,**} rw,
-  owner /tmp/vscode-ipc-@{uuid}.sock rw,
+  owner @{tmp}/@{uuid} rw,
+  owner @{tmp}/vscode-*/{,**} rw,
+  owner @{tmp}/vscode-ipc-@{uuid}.sock rw,
 
   owner @{run}/user/@{uid}/vscode-@{hex}-*-{shared,main}.sock rw,
   owner @{run}/user/@{uid}/vscode-git-@{hex}.sock rw,

apparmor.d/profiles-a-f/code-extension-git-askpass

@@ -23,7 +23,7 @@ profile code-extension-git-askpass @{exec_path} {
 
   /usr/share/terminfo/** r,
 
-  owner /tmp/tmp.* rw,
+  owner @{tmp}/tmp.* rw,
 
   /dev/tty rw,
 

apparmor.d/profiles-a-f/conky

@@ -141,7 +141,7 @@ profile conky @{exec_path} {
 
   @{PROC}/@{pid}/net/route r,
 
-  owner /tmp/xauth-@{int}-_[0-9] r,
+  owner @{tmp}/xauth-@{int}-_[0-9] r,
 
   /usr/share/X11/XErrorDB r,
 

apparmor.d/profiles-a-f/cpuid

@@ -17,7 +17,7 @@ profile cpuid @{exec_path} {
 
   /dev/cpu/@{int}/cpuid r,
 
-  owner /tmp/cpuid* rw,
+  owner @{tmp}/cpuid* rw,
 
   include if exists <local/cpuid>
 }

apparmor.d/profiles-a-f/cups-notifier-dbus

@@ -19,7 +19,7 @@ profile cups-notifier-dbus @{exec_path} {
  
   /etc/cups/client.conf r,
 
-  owner /tmp/cups-dbus-notifier-lockfile rwk,
+  owner @{tmp}/cups-dbus-notifier-lockfile rwk,
   
   include if exists <local/cups-notifier-dbus>
 }

apparmor.d/profiles-a-f/cups-pk-helper-mechanism

@@ -26,7 +26,7 @@ profile cups-pk-helper-mechanism @{exec_path} {
 
   /etc/cups/ppd/*.ppd r,
 
-  owner /tmp/[a-z0-9]* rw,
+  owner @{tmp}/[a-z0-9]* rw,
 
   @{run}/cups/cups.sock rw,
 

apparmor.d/profiles-a-f/cupsd

@@ -94,7 +94,7 @@ profile cupsd @{exec_path} flags=(attach_disconnected) {
         @{PROC}/@{pids}/fd/ r,
   owner @{PROC}/@{pid}/mounts r,
   
-  owner /tmp/*_latest_print_info w,
+  owner @{tmp}/*_latest_print_info w,
 
   /dev/tty rw,
 

apparmor.d/profiles-a-f/deltachat-desktop

@@ -48,10 +48,10 @@ profile deltachat-desktop @{exec_path} {
   owner @{user_config_dirs}/DeltaChat/ rw,
   owner @{user_config_dirs}/DeltaChat/** rwk,
 
-  owner /tmp/@{hex}/ rw,
-  owner /tmp/@{hex}/db.sqlite-blobs/ rw,
-  owner /tmp/@{hex}/db.sqlite rwk,
-  owner /tmp/@{hex}/db.sqlite-journal rw,
+  owner @{tmp}/@{hex}/ rw,
+  owner @{tmp}/@{hex}/db.sqlite-blobs/ rw,
+  owner @{tmp}/@{hex}/db.sqlite rwk,
+  owner @{tmp}/@{hex}/db.sqlite-journal rw,
 
              @{PROC}/ r,
        owner @{PROC}/@{pid}/fd/ r,

apparmor.d/profiles-a-f/dhclient-script

@@ -56,8 +56,8 @@ profile dhclient-script @{exec_path} {
   /var/lib/dhcp/dhclient.leases r,
   /var/lib/samba/dhcp.conf{,.new} rw,
 
-  owner /tmp/dhclient-script.debug rw,
-  owner /tmp/variables.txt w,
+  owner @{tmp}/dhclient-script.debug rw,
+  owner @{tmp}/variables.txt w,
 
   @{run}/chrony-dhcp/ rw,
   @{run}/systemd/netif/leases/ r,

apparmor.d/profiles-a-f/dkms

@@ -85,11 +85,11 @@ profile dkms @{exec_path} flags=(attach_disconnected) {
 
   owner @{HOME}/ r,
 
-  owner /tmp/* rw,
-  owner /tmp/cc* rw,
-  owner /tmp/dkms.*/ rw,
-  owner /tmp/sh-thd.* rw,
-  owner /tmp/tmp.* rw,
+  owner @{tmp}/* rw,
+  owner @{tmp}/cc* rw,
+  owner @{tmp}/dkms.*/ rw,
+  owner @{tmp}/sh-thd.* rw,
+  owner @{tmp}/tmp.* rw,
 
         @{PROC}/sys/kernel/osrelease r,
   owner @{PROC}/@{pid}/fd/ r,
@@ -109,7 +109,7 @@ profile dkms @{exec_path} flags=(attach_disconnected) {
 
     owner /boot/System.map-* r,
 
-    owner /tmp/tmp.* r,
+    owner @{tmp}/tmp.* r,
 
     @{sys}/module/compression r,
 

apparmor.d/profiles-a-f/dlocate

@@ -42,7 +42,7 @@ profile dlocate @{exec_path} {
   /var/lib/dpkg/info/*.conffiles r,
   /var/lib/dpkg/info/*.md5sums r,
 
-  owner /tmp/sh-thd.* rw,
+  owner @{tmp}/sh-thd.* rw,
 
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/fd/2 w,

apparmor.d/profiles-a-f/dmidecode

@@ -14,7 +14,7 @@ profile dmidecode @{exec_path} {
 
   @{exec_path} mr,
 
-  owner /tmp/dump.bin rw,
+  owner @{tmp}/dump.bin rw,
 
   @{sys}/firmware/dmi/tables/DMI r,
   @{sys}/firmware/dmi/tables/smbios_entry_point r,

apparmor.d/profiles-a-f/downloadhelper

@@ -33,7 +33,7 @@ profile downloadhelper @{exec_path} {
   owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.*/startupCache/startupCache.*.little r,
   owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.*/safebrowsing-updating/google@{int}/goog-phish-proto-@{int}.vlpset rw,
 
-  owner /tmp/vdh-*.tmp rw,
+  owner @{tmp}/vdh-*.tmp rw,
 
   @{sys}/devices/system/node/ r,
   @{sys}/devices/system/node/node@{int}/meminfo r,

apparmor.d/profiles-a-f/dumpcap

@@ -44,8 +44,8 @@ profile dumpcap @{exec_path} {
   /dev/ r,
 
   # Traffic log files
-  owner /tmp/wireshark_*.pcapng rw,
-  owner /tmp/*.pcap rw,
+  owner @{tmp}/wireshark_*.pcapng rw,
+  owner @{tmp}/*.pcap rw,
 
   # file_inherit
   owner @{HOME}/.xsession-errors w,

apparmor.d/profiles-a-f/engrampa

@@ -76,7 +76,7 @@ profile engrampa @{exec_path} {
   owner @{user_share_dirs}/ r,
 
         /tmp/ r,
-  owner /tmp/** rw,
+  owner @{tmp}/** rw,
 
   @{run}/mount/utab r,
 

apparmor.d/profiles-a-f/etckeeper

@@ -57,7 +57,7 @@ profile etckeeper @{exec_path} {
   owner @{HOME}/.netrc r,
   owner @{user_config_dirs}/git/{,*} rw,
 
-  owner /tmp/etckeeper-git* rw,
+  owner @{tmp}/etckeeper-git* rw,
 
   owner @{PROC}/@{pid}/fd/ r,
 

apparmor.d/profiles-a-f/evince

@@ -52,9 +52,9 @@ profile evince @{exec_path} {
   owner @{user_share_dirs}/gvfs-metadata/{,*} r,
   owner @{user_config_dirs}/evince/{,*} rw,
 
-  owner /tmp/*.pdf r,
-  owner /tmp/evince-*/{,**} rw,
-  owner /tmp/gtkprint* rw,
+  owner @{tmp}/*.pdf r,
+  owner @{tmp}/evince-*/{,**} rw,
+  owner @{tmp}/gtkprint* rw,
 
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mountinfo r,

apparmor.d/profiles-a-f/evince-thumbnailer

@@ -15,8 +15,8 @@ profile evince-thumbnailer @{exec_path} flags=(attach_disconnected) {
   /usr/share/mime/mime.cache r,
   /usr/share/poppler/{,**} r,
 
-  owner /tmp/gnome-desktop-file-to-thumbnail.pdf r,
-  owner /tmp/gnome-desktop-thumbnailer.png w,
+  owner @{tmp}/gnome-desktop-file-to-thumbnail.pdf r,
+  owner @{tmp}/gnome-desktop-thumbnailer.png w,
 
   include if exists <local/evince-thumbnailer>
 }

apparmor.d/profiles-a-f/ffmpeg

@@ -32,8 +32,8 @@ profile ffmpeg @{exec_path} {
   owner @{user_music_dirs}/** rw,
   owner @{user_videos_dirs}/** rw,
 
-  owner /tmp/*.{png,jpg} rw,  # To generate thumbnails in some apps
-  owner /tmp/vidcutter/** rw, # TMP files for apps using ffmpeg
+  owner @{tmp}/*.{png,jpg} rw,  # To generate thumbnails in some apps
+  owner @{tmp}/vidcutter/** rw, # TMP files for apps using ffmpeg
 
   @{sys}/devices/system/node/ r,
   @{sys}/devices/system/node/node[0-9]/meminfo r,

apparmor.d/profiles-a-f/flatpak

@@ -70,7 +70,7 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
 
         /tmp/#@{int} rw,
   owner /dev/shm/flatpak*/{,**} rw,
-  owner /tmp/ostree-gpg-*/{,**} rw,
+  owner @{tmp}/ostree-gpg-*/{,**} rw,
 
         @{run}/.userns r,
         @{run}/user/@{uid}/.dbus-proxy/ w,
@@ -107,8 +107,8 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
 
     @{HOME}/@{XDG_GPG_DIR}/*.conf r,
 
-    owner /tmp/ostree-gpg-*/ rw,
-    owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
+    owner @{tmp}/ostree-gpg-*/ rw,
+    owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
 
     include if exists <local/flatpak_gpg>
   }

apparmor.d/profiles-a-f/flatpak-system-helper

@@ -45,7 +45,7 @@ profile flatpak-system-helper @{exec_path} {
 
   owner /{var/,}tmp/#@{int} rw,
   owner /{var/,}tmp/ostree-gpg-*/ rw,
-  owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
+  owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
 
         @{PROC}/@{pid}/stat r,
   owner @{PROC}/@{pid}/fd/ r,
@@ -62,8 +62,8 @@ profile flatpak-system-helper @{exec_path} {
     @{lib}/{,gnupg/}scdaemon rix,
     @{bin}/gpg-agent rix,
 
-    owner /tmp/ostree-gpg-*/ r,
-    owner /tmp/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
+    owner @{tmp}/ostree-gpg-*/ r,
+    owner @{tmp}/ostree-gpg-*/** rwkl -> /tmp/ostree-gpg-*/**,
 
     owner @{PROC}/@{pid}/fd/ r,
     owner @{PROC}/@{pid}/task/@{tid}/comm rw,

apparmor.d/profiles-a-f/frontend

@@ -74,7 +74,7 @@ profile frontend @{exec_path} flags=(complain) {
   /etc/inputrc r,
   /etc/shadow r,
 
-  owner /tmp/file* w,
+  owner @{tmp}/file* w,
   owner /var/cache/debconf/* rwk,
 
   @{HOME}/.Xauthority r,
@@ -119,7 +119,7 @@ profile frontend @{exec_path} flags=(complain) {
     @{run}/         r,
     @{run}/**       rw,
           /tmp/     r,
-    owner /tmp/**   rw,
+    owner @{tmp}/**   rw,
 
   }