feat(abs): add the sqlite abstraction.

apparmor.d/abstractions/common/app

@@ -28,6 +28,7 @@
   include <abstractions/nameservice-strict>
   include <abstractions/p11-kit>
   include <abstractions/path>
+  include <abstractions/sqlite>
   include <abstractions/ssl_certs>
   include <abstractions/video>
 
@@ -63,7 +64,6 @@
   owner @{tmp}/** rmwk,
   owner /dev/shm/** rwlk -> /dev/shm/**,
   owner /var/cache/tmp/** rwlk -> /var/cache/tmp/**,
-  owner /var/tmp/etilqs_@{sqlhex} rw,
 
   @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
 

apparmor.d/abstractions/sqlite

@@ -0,0 +1,23 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# SQlite temporary files (hexadecimal from 12 to 16 characters)
+
+  abi <abi/4.0>,
+
+  owner /var/tmp/etilqs_@{hex12} rw,
+  owner /var/tmp/etilqs_@{hex12}@{h} rw,
+  owner /var/tmp/etilqs_@{hex12}@{hex2} rw,
+  owner /var/tmp/etilqs_@{hex15} rw,
+  owner /var/tmp/etilqs_@{hex16} rw,
+
+  owner @{tmp}/etilqs_@{hex12} rw,
+  owner @{tmp}/etilqs_@{hex12}@{h} rw,
+  owner @{tmp}/etilqs_@{hex12}@{hex2} rw,
+  owner @{tmp}/etilqs_@{hex15} rw,
+  owner @{tmp}/etilqs_@{hex16} rw,
+
+  include if exists <abstractions/sqlite.d>
+
+# vim:syntax=apparmor

apparmor.d/groups/gnome/gnome-music

@@ -17,6 +17,7 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) {
   include <abstractions/nameservice-strict>
   include <abstractions/p11-kit>
   include <abstractions/python>
+  include <abstractions/sqlite>
   include <abstractions/ssl_certs>
 
   network inet stream,
@@ -51,8 +52,6 @@ profile gnome-music @{exec_path} flags=(attach_disconnected) {
   @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
 
   owner @{tmp}/grilo-plugin-cache-[0-9A-Z]*/ rw,
-  owner @{tmp}/etilqs_@{sqlhex} rw,
-  owner /var/tmp/etilqs_@{sqlhex} rw,
 
         @{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
   owner @{PROC}/@{pid}/mounts r,

apparmor.d/groups/gnome/localsearch

@@ -23,6 +23,7 @@ profile localsearch @{exec_path} flags=(attach_disconnected) {
   include <abstractions/graphics>
   include <abstractions/gstreamer>
   include <abstractions/nameservice-strict>
+  include <abstractions/sqlite>
 
   network netlink raw,
 
@@ -56,9 +57,6 @@ profile localsearch @{exec_path} flags=(attach_disconnected) {
   owner @{user_cache_dirs}/tracker3/files/ rw,
   owner @{user_cache_dirs}/tracker3/files/** rwk,
 
-  owner @{tmp}/etilqs_@{sqlhex} rw,
-  owner /var/tmp/etilqs_@{sqlhex} rw,
-
   @{run}/mount/utab r,
 
   @{run}/udev/data/c@{dynamic}:@{int} r,  # For dynamic assignment range 234 to 254, 384 to 511

apparmor.d/groups/gnome/tracker-miner

@@ -21,6 +21,7 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
   include <abstractions/gnome-strict>
   include <abstractions/gstreamer>
   include <abstractions/nameservice-strict>
+  include <abstractions/sqlite>
 
   network netlink raw,
 
@@ -63,9 +64,6 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
   owner @{gdm_config_dirs}/dconf/user r,
   owner @{gdm_share_dirs}/applications/ r,
 
-  owner @{tmp}/etilqs_@{sqlhex} rw,
-  owner /var/tmp/etilqs_@{sqlhex} rw,
-
   # Allow to search user files
   owner @{HOME}/{,**} r,
   owner @{MOUNTS}/{,**} r,

apparmor.d/profiles-a-f/dropbox

@@ -23,6 +23,7 @@ profile dropbox @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/python>
   include <abstractions/qt5-settings-write>
+  include <abstractions/sqlite>
   include <abstractions/ssl_certs>
 
   @{exec_path} mr,
@@ -61,8 +62,6 @@ profile dropbox @{exec_path} {
   # Dropbox first tries the /tmp/ dir, and if it's denied it uses the /var/tmp/ dir instead
   owner @{tmp}/dropbox-antifreeze-* rw,
   owner @{tmp}/#@{int} rw,
-  owner @{tmp}/etilqs_@{sqlhex} rw,
-  owner /var/tmp/etilqs_@{sqlhex} rw,
 
   @{run}/systemd/users/@{uid} r,
 

apparmor.d/profiles-a-f/fractal

@@ -13,6 +13,7 @@ profile fractal @{exec_path} flags=(attach_disconnected) {
   include <abstractions/common/gnome>
   include <abstractions/gstreamer>
   include <abstractions/nameservice-strict>
+  include <abstractions/sqlite>
   include <abstractions/ssl_certs>
 
   network inet dgram,
@@ -34,7 +35,6 @@ profile fractal @{exec_path} flags=(attach_disconnected) {
   owner @{tmp}/.@{rand6} rw,
   owner @{tmp}/.goutputstream-@{rand6} rw,
   owner @{tmp}/@{rand6} rw,
-  owner @{tmp}/etilqs_@{sqlhex} rw,
 
   owner @{run}/user/@{uid}/fractal/{,**} rw,
 

apparmor.d/profiles-a-f/fwupd

@@ -18,6 +18,7 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) {
   include <abstractions/disks-write>
   include <abstractions/fonts>
   include <abstractions/nameservice-strict>
+  include <abstractions/sqlite>
 
   capability dac_override,
   capability dac_read_search,
@@ -77,7 +78,6 @@ profile fwupd @{exec_path} flags=(attach_disconnected,complain) {
   @{MOUNTDIRS}/*/{,@{efi}/}EFI/{,**} r,
 
         /var/lib/flatpak/exports/share/mime/mime.cache r,
-        /var/tmp/etilqs_@{sqlhex} rw,
   owner /var/cache/fwupd/ rw,
   owner /var/cache/fwupd/** rwk,
   owner /var/lib/fwupd/ rw,

apparmor.d/profiles-g-l/gpo

@@ -11,10 +11,11 @@ include <tunables/global>
 profile gpo @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
-  include <abstractions/python>
   include <abstractions/nameservice-strict>
-  include <abstractions/user-download-strict>
+  include <abstractions/python>
+  include <abstractions/sqlite>
   include <abstractions/ssl_certs>
+  include <abstractions/user-download-strict>
 
   network inet dgram,
   network inet6 dgram,
@@ -36,9 +37,6 @@ profile gpo @{exec_path} {
   owner @{HOME}/gPodder/ rw,
   owner @{HOME}/gPodder/** rwk,
 
-  owner @{tmp}/etilqs_@{sqlhex} rw,
-  owner /var/tmp/etilqs_@{sqlhex} rw,
-
   owner @{PROC}/@{pid}/fd/ r,
 
   include if exists <local/gpo>

apparmor.d/profiles-g-l/gpodder

@@ -14,6 +14,7 @@ profile gpodder @{exec_path} {
   include <abstractions/fontconfig-cache-read>
   include <abstractions/nameservice-strict>
   include <abstractions/python>
+  include <abstractions/sqlite>
   include <abstractions/ssl_certs>
   include <abstractions/user-download-strict>
 
@@ -47,9 +48,6 @@ profile gpodder @{exec_path} {
   owner @{HOME}/gPodder/ rw,
   owner @{HOME}/gPodder/** rwk,
 
-  owner @{tmp}/etilqs_@{sqlhex} rw,
-  owner /var/tmp/etilqs_@{sqlhex} rw,
-
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mounts r,
   owner @{PROC}/@{pid}/mountinfo r,

apparmor.d/profiles-m-r/protonmail-bridge-core

@@ -17,6 +17,7 @@ profile protonmail-bridge-core @{exec_path} flags=(attach_disconnected) {
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
+  include <abstractions/sqlite>
 
   network inet dgram,
   network inet6 dgram,
@@ -43,8 +44,6 @@ profile protonmail-bridge-core @{exec_path} flags=(attach_disconnected) {
   owner "@{user_config_dirs}/autostart/Proton Mail Bridge.desktop" rw,
 
   owner @{tmp}/bridge@{int} rw,
-  owner @{tmp}/etilqs_@{sqlhex} rw,
-  owner /var/tmp/etilqs_@{sqlhex} rw,
 
   @{PROC}/ r,
   @{PROC}/1/cgroup r,

apparmor.d/profiles-m-r/psi

@@ -18,6 +18,7 @@ profile psi @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/qt5-compose-cache-write>
   include <abstractions/qt5-settings-write>
+  include <abstractions/sqlite>
   include <abstractions/ssl_certs>
   include <abstractions/thumbnails-cache-read>
   include <abstractions/user-download-strict>
@@ -54,7 +55,6 @@ profile psi @{exec_path} {
   owner @{user_share_dirs}/psi/** rwk,
 
   owner @{tmp}/#@{int} rw,
-  owner @{tmp}/etilqs_@{sqlhex} rw,
   owner @{tmp}/Psi.* rwl -> /tmp/#@{int},
 
   @{att}/@{run}/systemd/inhibit/@{int}.ref rw,

apparmor.d/profiles-m-r/psi-plus

@@ -18,6 +18,7 @@ profile psi-plus @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/qt5-compose-cache-write>
   include <abstractions/qt5-settings-write>
+  include <abstractions/sqlite>
   include <abstractions/ssl_certs>
   include <abstractions/thumbnails-cache-read>
   include <abstractions/user-download-strict>
@@ -54,7 +55,6 @@ profile psi-plus @{exec_path} {
   owner @{user_share_dirs}/psi+/** rwk,
 
   owner @{tmp}/#@{int} rw,
-  owner @{tmp}/etilqs_@{sqlhex} rw,
   owner @{tmp}/Psi+.* rwl -> /tmp/#@{int},
 
   @{att}/@{run}/systemd/inhibit/@{int}.ref rw,

apparmor.d/profiles-m-r/quiterss

@@ -18,6 +18,7 @@ profile quiterss @{exec_path} {
   include <abstractions/nameservice-strict>
   include <abstractions/qt5-compose-cache-write>
   include <abstractions/qt5-settings-write>
+  include <abstractions/sqlite>
   include <abstractions/ssl_certs>
   include <abstractions/user-download-strict>
 
@@ -47,8 +48,6 @@ profile quiterss @{exec_path} {
 
   owner @{tmp}/qtsingleapp-quiter-@{int}-@{int} rw,
   owner @{tmp}/qtsingleapp-quiter-@{int}-@{int}-lockfile rwk,
-  owner @{tmp}/etilqs_@{sqlhex} rw,
-  owner /var/tmp/etilqs_@{sqlhex} rw,
 
         @{PROC}/sys/kernel/random/boot_id r,
   owner @{PROC}/@{pid}/cmdline r,

apparmor.d/profiles-s-z/strawberry

@@ -21,6 +21,7 @@ profile strawberry @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   include <abstractions/nameservice-strict>
   include <abstractions/qt5-compose-cache-write>
   include <abstractions/qt5-settings-write>
+  include <abstractions/sqlite>
   include <abstractions/ssl_certs>
   include <abstractions/user-download-strict>
 
@@ -68,7 +69,6 @@ profile strawberry @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   owner @{tmp}/.*/s rw,
   owner @{tmp}/*= w,
   owner @{tmp}/#@{int} rw,
-  owner @{tmp}/etilqs_@{sqlhex} rw,
   owner @{tmp}/kdsingleapp-*-strawberry w,
   owner @{tmp}/kdsingleapp-*-strawberry.lock rwk,
   owner @{tmp}/qipc_{systemsem,sharedmemory}_*[a-f0-9]* rw,

apparmor.d/profiles-s-z/syncthing

@@ -12,6 +12,7 @@ profile syncthing @{exec_path} {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
+  include <abstractions/sqlite>
   include <abstractions/ssl_certs>
 
   network inet dgram,
@@ -35,9 +36,6 @@ profile syncthing @{exec_path} {
   /home/ r,
   @{user_sync_dirs}/{,**} rw,
 
-  owner /var/tmp/etilqs_@{sqlhex} rw,
-  owner @{tmp}/etilqs_@{sqlhex} rw,
-
         @{PROC}/@{pids}/net/route r,
         @{PROC}/bus/pci/devices r,
         @{PROC}/modules r,

apparmor.d/profiles-s-z/wechat-appimage

@@ -19,6 +19,7 @@ profile wechat-appimage @{exec_path} flags=(attach_disconnected) {
   include <abstractions/common/electron>
   include <abstractions/consoles>
   include <abstractions/path>
+  include <abstractions/sqlite>
 
   network netlink raw,
   network netlink dgram,
@@ -59,9 +60,6 @@ profile wechat-appimage @{exec_path} flags=(attach_disconnected) {
 
   owner @{user_documents_dirs}/xwechat_files/{,**} rwk,
 
-  owner @{tmp}/etilqs_@{sqlhex} rw,
-  owner /var/tmp/etilqs_@{sqlhex} rw,
-
   /dev/fuse rw,
   /dev/tty rw,
 

apparmor.d/tunables/multiarch.d/system

@@ -56,9 +56,6 @@
 # System Internal
 # ---------------
 
-# SQlite temporary files (hexadecimal from 12 to 16 characters)
-@{sqlhex}=@{hex12} @{hex12}@{h} @{hex12}@{hex2} @{hex15} @{hex16}
-
 # Shortcut for PCI device
 @{pci_id}=@{hex}:@{hex2}:@{hex2}.@{h}
 @{pci_bus}=pci@{hex4}:@{hex2}