feat(profile): rewrite the child-open* profiles.

apparmor.d/groups/children/child-open

@@ -13,29 +13,16 @@
 
 # Note: This profile does not specify an attachment path because it is
 # intended to be used only via "Px -> child-open" exec transitions
-# from other profiles. 
+# from other profiles.
 
 abi <abi/3.0>,
 
 include <tunables/global>
 
-@{exec_path}  = @{bin}/exo-open @{bin}/xdg-open 
-@{exec_path} += @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop @{lib}/gio-launch-desktop
 profile child-open {
   include <abstractions/base>
   include <abstractions/app-open>
-  include <abstractions/dri-enumerate>
-  include <abstractions/mesa>
-  include <abstractions/vulkan>
-  include <abstractions/xdg-open>
-
-  @{exec_path} mrix,
-
-  @{sh_path}               rix,
-  @{bin}/{,m,g}awk         rix,
-  @{bin}/basename          rix,
-  @{bin}/env               rix,
-  @{bin}/readlink          rix,
+  include <abstractions/app/open>
 
   include if exists <usr/child-open.d>
   include if exists <local/child-open>

apparmor.d/groups/children/child-open-browsers

@@ -17,11 +17,8 @@ include <tunables/global>
 
 profile child-open-browsers {
   include <abstractions/base>
-  include <abstractions/desktop>
+  include <abstractions/app/open>
 
-  @{open_path} mrix,
-
-  @{bin}/chromium               rPx,
   @{browsers_path}              rPx,
 
   include if exists <usr/child-open-browsers.d>

apparmor.d/groups/children/child-open-help

@@ -8,13 +8,9 @@ include <tunables/global>
 
 profile child-open-help {
   include <abstractions/base>
-  include <abstractions/desktop>
+  include <abstractions/app/open>
 
-  @{open_path} mrix,
-
-  @{bin}/chromium               rPx,
   @{browsers_path}              rPx,
-
   @{bin}/yelp                  rPUx,
 
   include if exists <usr/child-open-help.d>

apparmor.d/groups/children/child-open-strict

@@ -13,20 +13,10 @@ include <tunables/global>
 
 profile child-open-strict {
   include <abstractions/base>
-  include <abstractions/desktop>
+  include <abstractions/app/open>
 
-  @{open_path} mrix,
-  @{sh_path} r,
-
-  # Browsers
-  @{bin}/chromium               rPx,
   @{browsers_path}              rPx,
-
-  # Files explorer
-  @{bin}/nautilus               rPx,
-  @{bin}/dolphin                rPx,
-
-  /dev/tty rw,
+  @{file_explorers_path}        rPx,
 
   include if exists <usr/child-open-strict.d>
   include if exists <local/child-open-strict>