feat(abs): reorganize the electron & chromium abs.

apparmor.d/abstractions/app/chromium

@@ -33,6 +33,7 @@
   include <abstractions/bus/org.gnome.ScreenSaver>
   include <abstractions/bus/org.gnome.SessionManager>
   include <abstractions/bus/org.kde.kwalletd>
+  include <abstractions/common/chromium>
   include <abstractions/dconf-write>
   include <abstractions/desktop>
   include <abstractions/devices-usb>
@@ -46,14 +47,6 @@
   include <abstractions/user-read-strict>
   include <abstractions/video>
 
-  userns,
-
-  capability setgid,
-  capability setuid,
-  capability sys_admin,
-  capability sys_chroot,
-  capability sys_ptrace,
-
   network inet dgram,
   network inet6 dgram,
   network inet stream,
@@ -112,21 +105,12 @@
   /etc/fstab r,
   /etc/{,opensc/}opensc.conf r,
 
-  /var/lib/dbus/machine-id r,
-  /etc/machine-id r,
-
   / r,
   owner @{HOME}/ r,
 
-  owner @{HOME}/.pki/ rw,
-  owner @{HOME}/.pki/nssdb/ rw,
-  owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
-
   owner @{user_cache_dirs}/gtk-3.0/**/*.cache r,
   owner @{user_config_dirs}/gtk-3.0/servers r,
-  owner @{user_share_dirs}/.@{domain}.@{rand6} rw,
+
   owner @{user_share_dirs}/icons/hicolor/.xdg-icon-resource-dummy w,
 
   owner @{config_dirs}/ rw,
@@ -151,10 +135,7 @@
 
         /tmp/ r,
         /var/tmp/ r,
-  owner @{tmp}/.@{domain}.@{rand6} rw,
-  owner @{tmp}/.@{domain}.@{rand6}/{,**} rw,
   owner @{tmp}/@{name}-crashlog-@{int}-@{int}.txt rw,
-  owner @{tmp}/scoped_dir@{rand6}/{,**} rw,
   owner @{tmp}/tmp.@{rand10} rw,
   owner @{tmp}/tmp.@{rand6} rw,
   owner @{tmp}/tmp.@{rand6}/ rw,
@@ -163,9 +144,6 @@
   owner @{run}/user/@{uid}/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer rw,
   owner @{run}/user/@{uid}/org.keepassxc.KeePassXC.BrowserServer rw,
 
-        /dev/shm/ r,
-  owner /dev/shm/.@{domain}.@{rand6} rw,
-
   @{run}/udev/data/c13:@{int}  r,         # for /dev/input/*
 
   @{sys}/bus/ r,
@@ -175,10 +153,7 @@
   @{sys}/devices/@{pci}/boot_vga r,
   @{sys}/devices/@{pci}/report_descriptor r,
   @{sys}/devices/**/uevent r,
-  @{sys}/devices/system/cpu/kernel_max r,
   @{sys}/devices/virtual/**/report_descriptor r,
-  @{sys}/devices/virtual/dmi/id/{sys_vendor,product_name} r,
-  @{sys}/devices/virtual/tty/tty@{int}/active r,
 
         @{PROC}/ r,
         @{PROC}/@{pid}/fd/ r,
@@ -192,18 +167,15 @@
   owner @{PROC}/@{pid}/clear_refs w,
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/environ r,
-  owner @{PROC}/@{pid}/gid_map w,
   owner @{PROC}/@{pid}/limits r,
   owner @{PROC}/@{pid}/mem r,
   owner @{PROC}/@{pid}/mountinfo r,
   owner @{PROC}/@{pid}/mounts r,
   owner @{PROC}/@{pid}/oom_{,score_}adj rw,
-  owner @{PROC}/@{pid}/setgroups w,
   owner @{PROC}/@{pid}/smaps_rollup r,
   owner @{PROC}/@{pid}/task/ r,
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,
   owner @{PROC}/@{pid}/task/@{tid}/stat r,
-  owner @{PROC}/@{pid}/uid_map w,
 
         /dev/ r,
         /dev/hidraw@{int} rw,

apparmor.d/abstractions/common/chromium

@@ -4,7 +4,13 @@
 # SPDX-License-Identifier: GPL-2.0-only
 
 # This abstraction is for chromium based application. Chromium based browsers
-# need to use abstractions/chromium instead.
+# need to use abstractions/app/chromium instead.
+
+# It works as a *function* and requires a variable to be provided as *arguments*
+# and set in the header of the calling profile. Example:
+#
+# @{domain} = org.chromium.Chromium
+#
 
   abi <abi/4.0>,
 
@@ -22,19 +28,24 @@
   owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
   owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
 
-  owner @{user_share_dirs}/.org.chromium.Chromium.@{rand6} rw,
+  owner @{user_share_dirs}/.@{domain}.@{rand6} rw,
 
-        /tmp/ r,
+  owner @{tmp}/.@{domain}.@{rand6} rw,
-        /var/tmp/ r,
+  owner @{tmp}/.@{domain}.@{rand6}/ rw,
-  owner @{tmp}/.org.chromium.Chromium.@{rand6} rw,
+  owner @{tmp}/.@{domain}.@{rand6}/SingletonCookie w,
-  owner @{tmp}/.org.chromium.Chromium.@{rand6}/{,**} rw,
+  owner @{tmp}/.@{domain}.@{rand6}/SingletonSocket w,
   owner @{tmp}/scoped_dir@{rand6}/ rw,
   owner @{tmp}/scoped_dir@{rand6}/SingletonCookie w,
   owner @{tmp}/scoped_dir@{rand6}/SingletonSocket w,
   owner @{tmp}/scoped_dir@{rand6}/SS w,
 
         /dev/shm/ r,
-  owner /dev/shm/.org.chromium.Chromium.@{rand6} rw,
+  owner /dev/shm/.@{domain}.@{rand6} rw,
+
+  @{sys}/devices/system/cpu/kernel_max r,
+  @{sys}/devices/virtual/dmi/id/product_name r,
+  @{sys}/devices/virtual/dmi/id/sys_vendor r,
+  @{sys}/devices/virtual/tty/tty@{int}/active r,
 
   # If kernel.unprivileged_userns_clone = 1
   owner @{PROC}/@{pid}/setgroups w,

apparmor.d/abstractions/common/electron

@@ -7,13 +7,15 @@
 # in the header of the calling profile. Example:
 #
 # @{name} = spotify
-# @{lib_dirs} = /opt/@{name}
+# @{domain} = org.chromium.chromium
+# @{lib_dirs} = /opt/@{name}/ /usr/share/@{name}/
 # @{config_dirs} = @{user_config_dirs}/@{name}
 # @{cache_dirs} = @{user_cache_dirs}/@{name}
 #
 
   abi <abi/4.0>,
 
+  include <abstractions/common/chromium>
   include <abstractions/dconf-write>
   include <abstractions/desktop>
   include <abstractions/fontconfig-cache-read>
@@ -21,14 +23,6 @@
   include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
 
-  userns,
-
-  capability setgid, # If kernel.unprivileged_userns_clone = 1
-  capability setuid, # If kernel.unprivileged_userns_clone = 1
-  capability sys_admin,
-  capability sys_chroot,
-  capability sys_ptrace,
-
   @{bin}/electron rix,
   @{bin}/electron@{int} rix,
   @{lib}/electron@{int}/{,**} r,
@@ -48,31 +42,7 @@
   owner @{cache_dirs}/ rw,
   owner @{cache_dirs}/** rwlk -> @{cache_dirs}/**,
 
-  owner @{HOME}/.pki/ rw,
-  owner @{HOME}/.pki/nssdb/ rw,
-  owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
-
   owner @{user_config_dirs}/electron-flags.conf r,
-  owner @{user_share_dirs}/.org.chromium.Chromium.@{rand6} rw,
-
-  owner @{tmp}/.org.chromium.Chromium.@{rand6} rw,
-  owner @{tmp}/.org.chromium.Chromium.@{rand6}/ rw,
-  owner @{tmp}/.org.chromium.Chromium.@{rand6}/SingletonCookie w,
-  owner @{tmp}/.org.chromium.Chromium.@{rand6}/SingletonSocket w,
-  owner @{tmp}/scoped_dir@{rand6}/ rw,
-  owner @{tmp}/scoped_dir@{rand6}/SingletonCookie w,
-  owner @{tmp}/scoped_dir@{rand6}/SingletonSocket w,
-  owner @{tmp}/scoped_dir@{rand6}/SS w,
-
-        /dev/shm/ r,
-  owner /dev/shm/.org.chromium.Chromium.@{rand6} rw,
-
-  @{sys}/devices/system/cpu/kernel_max r,
-  @{sys}/devices/virtual/dmi/id/product_name r,
-  @{sys}/devices/virtual/dmi/id/sys_vendor r,
-  @{sys}/devices/virtual/tty/tty@{int}/active r,
 
         @{sys}/fs/cgroup/user.slice/cpu.max r,
         @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r,
@@ -89,15 +59,12 @@
   owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/fd/ r,
-  owner @{PROC}/@{pid}/gid_map w, # If kernel.unprivileged_userns_clone = 1
   owner @{PROC}/@{pid}/mountinfo r,
   owner @{PROC}/@{pid}/oom_score_adj rw,
-  owner @{PROC}/@{pid}/setgroups w, # If kernel.unprivileged_userns_clone = 1
   owner @{PROC}/@{pid}/stat r,
   owner @{PROC}/@{pid}/statm r,
   owner @{PROC}/@{pid}/task/ r,
   owner @{PROC}/@{pid}/task/@{tid}/stat r,
-  owner @{PROC}/@{pid}/uid_map w, # If kernel.unprivileged_userns_clone = 1
 
   deny @{user_share_dirs}/gvfs-metadata/* r,
 

apparmor.d/groups/network/mullvad-gui

@@ -7,6 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{name} = Mullvad?VPN
+@{domain} = org.chromium.Chromium
 @{lib_dirs} = /opt/@{name}
 @{config_dirs} = @{user_config_dirs}/@{name}
 @{cache_dirs} = @{user_cache_dirs}/@{name}
@@ -31,10 +32,6 @@ profile mullvad-gui @{exec_path} flags=(attach_disconnected) {
   @{bin}/gsettings     rPx,
   @{open_path}         rPx -> child-open-browsers,
 
-  owner @{user_cache_dirs}/dconf/user rw,
-
-  owner @{tmp}/.org.chromium.Chromium.@{rand6}/@{name}*.png rw,
-
   @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
 
   @{run}/mullvad-vpn rw,

apparmor.d/groups/steam/steam

@@ -21,10 +21,12 @@ abi <abi/4.0>,
 
 include <tunables/global>
 
-@{runtime} = SteamLinuxRuntime_{sniper,soldier}
+@{domain} = org.chromium.Chromium
+@{runtime_name} = sniper soldier
+@{runtime} = SteamLinuxRuntime_@{runtime_name} steam-runtime-steamrt
 @{share_dirs} = @{user_share_dirs}/Steam @{HOME}/.steam/debian-installation
-@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64}
+@{lib_dirs} = @{share_dirs}/ubuntu@{int2}_{32,64} steamrt64
-@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper}
+@{runtime_dirs} = @{lib_dirs}/steam-runtime{,-sniper} @{lib_dirs}/steam-runtime-steamrt
 @{app_dirs} = @{share_dirs}/steamapps/common/
 
 @{exec_path} = @{share_dirs}/steam.sh

apparmor.d/profiles-a-f/deltachat-desktop

@@ -7,6 +7,7 @@ abi <abi/4.0>,
 
 include <tunables/global>
 
+@{domain} = org.chromium.Chromium
 @{lib_dirs} = @{lib}/deltachat-desktop @{lib}/deltachat /opt/DeltaChat/
 
 @{exec_path} = @{bin}/deltachat-desktop @{lib_dirs}/deltachat-desktop

apparmor.d/profiles-a-f/discord

@@ -8,6 +8,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{name} = discord
+@{domain} = org.chromium.Chromium
 @{lib_dirs} = /usr/share/@{name} /opt/@{name}
 @{config_dirs} = @{user_config_dirs}/@{name} @{user_config_dirs}/discordptb
 @{cache_dirs} = @{user_cache_dirs}/@{name}
@@ -48,7 +49,6 @@ profile discord @{exec_path} flags=(attach_disconnected) {
   owner @{config_dirs}/@{version}/modules/** m,
 
   owner "@{tmp}/Discord Crashes/" rw,
-  owner @{tmp}/.org.chromium.Chromium.@{rand6}/** rw,
   owner @{tmp}/discord.sock rw,
   owner @{tmp}/net-export/ rw,
 
@@ -57,6 +57,8 @@ profile discord @{exec_path} flags=(attach_disconnected) {
   owner @{PROC}/@{pid}/mem r,
   owner @{PROC}/@{pid}/task/@{tid}/comm r,
 
+  deny ptrace read,
+
   include if exists <local/discord>
 }
 

apparmor.d/profiles-a-f/freetube

@@ -8,6 +8,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{name} = {F,f}ree{T,t}ube{,-vue}
+@{domain} = org.chromium.Chromium
 @{lib_dirs} = @{lib}/@{name} /opt/@{name}
 @{config_dirs} = @{user_config_dirs}/@{name}
 @{cache_dirs} = @{user_cache_dirs}/@{name}
@@ -39,7 +40,6 @@ profile freetube @{exec_path} flags=(attach_disconnected) {
   @{open_path}         rPx -> child-open-strict,
 
   deny @{sys}/devices/@{pci}/usb@{int}/** r,
-  deny /dev/ r,
 
   include if exists <local/freetube>
 }

apparmor.d/profiles-g-l/linuxqq

@@ -7,6 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{name} = QQ
+@{domain} = org.chromium.Chromium
 @{lib_dirs} = /opt/QQ/
 @{config_dirs} = @{user_config_dirs}/@{name}
 @{cache_dirs} = @{user_cache_dirs}/@{name}

apparmor.d/profiles-m-r/protonmail

@@ -8,6 +8,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{name} = proton-mail "Proton Mail"
+@{domain} = org.chromium.Chromium
 @{lib_dirs} = /opt/@{name}
 @{config_dirs} = @{user_config_dirs}/@{name}
 @{cache_dirs} = @{user_cache_dirs}/@{name}

apparmor.d/profiles-s-z/session-desktop

@@ -7,6 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{name} = {S,s}ession
+@{domain} = org.chromium.Chromium
 @{lib_dirs} = /opt/@{name}
 @{config_dirs} = @{user_config_dirs}/@{name}
 @{cache_dirs} = @{user_cache_dirs}/@{name}

apparmor.d/profiles-s-z/signal-desktop

@@ -8,6 +8,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{name} = signal-desktop{,-beta}
+@{domain} = org.chromium.Chromium
 @{lib_dirs} = @{lib}/signal-desktop /opt/Signal{,?Beta}
 @{config_dirs} = @{user_config_dirs}/Signal{,?Beta}
 @{cache_dirs} = @{user_cache_dirs}/@{name}

apparmor.d/profiles-s-z/spotify

@@ -8,6 +8,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{name} = spotify
+@{domain} = org.chromium.Chromium
 @{lib_dirs} = /opt/@{name}/ /usr/share/@{name}/
 @{config_dirs} = @{user_config_dirs}/@{name}
 @{cache_dirs} = @{user_cache_dirs}/@{name}
@@ -57,8 +58,6 @@ profile spotify @{exec_path} flags=(attach_disconnected) {
   owner @{cache_dirs}/WidevineCdm/**/libwidevinecdm.so rm,
   owner @{config_dirs}/*/WidevineCdm/**/libwidevinecdm.so rm,
 
-  owner @{tmp}/.org.chromium.Chromium.@{rand6}/** rw,
-
         @{PROC}/@{pid}/net/unix r,
         @{PROC}/pressure/* r,
   owner @{PROC}/@{pid}/clear_refs w,

apparmor.d/profiles-s-z/superproductivity

@@ -7,6 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{name} = super{p,P}roductivity
+@{domain} = org.chromium.Chromium
 @{lib_dirs} = /opt/@{name}
 @{config_dirs} = @{user_config_dirs}/@{name}
 @{cache_dirs} = @{user_cache_dirs}/@{name}

apparmor.d/profiles-s-z/vesktop

@@ -8,6 +8,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{name} = vesktop
+@{domain} = org.chromium.Chromium
 @{lib_dirs} = @{lib}/@{name}
 @{config_dirs} = @{user_config_dirs}/@{name}
 @{cache_dirs} = @{user_cache_dirs}/@{name}
@@ -33,7 +34,6 @@ profile vesktop @{exec_path} flags=(attach_disconnected) {
   @{bin}/speech-dispatcher rPx,
   @{open_path}             rPx -> child-open,
 
-  owner /tmp/.org.chromium.Chromium.@{rand6} mr,
   owner @{run}/user/@{uid}/discord-ipc-@{int} rw,
 
   @{sys}/devices/@{pci}/usb@{int}/**/interface r,

apparmor.d/profiles-s-z/wechat

@@ -7,6 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{name} = wechat
+@{domain} = org.chromium.Chromium
 @{lib_dirs} = /opt/wechat/
 @{config_dirs} = @{user_config_dirs}/@{name}
 @{cache_dirs} = @{user_cache_dirs}/@{name}

apparmor.d/profiles-s-z/wechat-appimage

@@ -7,6 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{name} = wechat-appimage
+@{domain} = org.chromium.Chromium
 @{lib_dirs} = /opt/wechat-appimage/
 @{config_dirs} = @{user_config_dirs}/@{name}
 @{cache_dirs} = @{user_cache_dirs}/@{name}

apparmor.d/profiles-s-z/wechat-universal

@@ -7,6 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{name} = wechat-universal
+@{domain} = org.chromium.Chromium
 @{lib_dirs} = /opt/wechat-universal/
 @{config_dirs} = @{user_config_dirs}/@{name}
 @{cache_dirs} = @{user_cache_dirs}/@{name}

apparmor.d/profiles-s-z/wemeet

@@ -6,6 +6,8 @@ abi <abi/4.0>,
 
 include <tunables/global>
 
+@{domain} = org.chromium.Chromium
+
 @{exec_path} = @{bin}/wemeet
 @{exec_path} += /opt/wemeet/bin/wemeetapp
 @{exec_path} += /opt/wemeet/bin/QtWebEngineProcess