feat(profiles): add some core dbus rules.

apparmor.d/groups/freedesktop/geoclue

@@ -7,15 +7,57 @@ abi <abi/3.0>,
 include <tunables/global>
 
 @{exec_path} = @{libexec}/geoclue
-profile geoclue @{exec_path} {
+profile geoclue @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
+  include <abstractions/dbus-strict>
 
   network netlink raw,
 
+  dbus (send,receive) bus=system path=/org/freedesktop/GeoClue2/{Agent,Manager}
+       interface=org.freedesktop.{DBus.Properties,GeoClue2*},
+
+  dbus send bus=system path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus
+       member={GetConnectionUnixProcessID,GetConnectionUnixUser,ReleaseName,RequestName}
+       peer=(name=org.freedesktop.DBus),
+
+  dbus send bus=system path=/
+       interface=org.freedesktop.Avahi.Server
+       member={GetAPIVersion,GetState,ServiceBrowserNew},
+
+  dbus send bus=system path=/
+       interface=org.freedesktop.DBus.Peer
+       member=Ping,
+
+  dbus send bus=system path=/fi/w[0-9]/wpa_supplicant[0-9]
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll,
+
+  dbus send bus=system path=/org/freedesktop/ModemManager[0-9]
+       interface=org.freedesktop.DBus.ObjectManager
+       member=GetManagedObjects,
+
+  dbus send bus=system path=/org/freedesktop/NetworkManager
+       interface=org.freedesktop.DBus.Properties
+       member={GetAll,PropertiesChanged},
+
+  dbus receive bus=system path=/Client[0-9]/ServiceBrowser[0-9]
+       interface=org.freedesktop.Avahi.ServiceBrowser
+       member={AllForNow,CacheExhausted},
+
+  dbus receive bus=system path=/org/freedesktop/NetworkManager
+       interface=org.freedesktop.NetworkManager
+       member={CheckPermissions,StateChanged},
+
+  dbus bind bus=system 
+       name=org.freedesktop.GeoClue2,
+
   @{exec_path} mr,
 
   /etc/geoclue/{,**} r,
 
+  @{run}/systemd/journal/socket rw,
+
   @{PROC}/@{pids}/cgroup r,
 
   include if exists <local/geoclue>