feat(dbus): rewrite some dbus rules (1).

apparmor.d/profiles-s-z/snapd

@@ -47,7 +47,7 @@ profile snapd @{exec_path} {
   ptrace (read) peer=snap,
   ptrace (read) peer=@{systemd},
 
-  dbus (send) bus=system path=/org/freedesktop/
+  dbus send bus=system path=/org/freedesktop/
          interface=org.freedesktop.login1.Manager
          member={SetWallMessage,ScheduleShutdown}
          peer=(name=org.freedesktop.login1, label=systemd-logind),
@@ -55,12 +55,7 @@ profile snapd @{exec_path} {
   dbus send bus=system path=/org/freedesktop/timedate1
        interface=org.freedesktop.DBus.Properties
        member=Get
-       peer=(name=org.freedesktop.timedate1),
-
-  dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority 
-       interface=org.freedesktop.PolicyKit1.Authority
-       member=CheckAuthorization 
-       peer=(name=org.freedesktop.PolicyKit1),
+       peer=(name=org.freedesktop.timedate1, label="{systemd-timedated,@{systemd}}"),
 
   @{exec_path} mrix,
 

apparmor.d/profiles-s-z/thunderbird

@@ -48,10 +48,7 @@ profile thunderbird @{exec_path} {
 
   ptrace peer=@{profile_name},
 
-  dbus send bus=session path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus
-       member=RequestName
-       peer=(name=org.freedesktop.DBus),
+  dbus bind bus=session name=org.mozilla.thunderbird.*,
 
   dbus send bus=system path=/org/freedesktop/RealtimeKit1
        member={Get,MakeThreadHighPriority,MakeThreadRealtime}
@@ -82,8 +79,6 @@ profile thunderbird @{exec_path} {
        member=Introspect
        peer=(name=:*, label=gnome-shell),
 
-  dbus bind bus=session name=org.mozilla.thunderbird.*,
-
   @{exec_path} mrix,
 
   @{bin}/{,ba,da}sh  rix,

apparmor.d/profiles-s-z/vlc

@@ -13,7 +13,6 @@ profile vlc @{exec_path} {
   include <abstractions/audio>
   include <abstractions/bus/atspi>
   include <abstractions/dbus-accessibility-strict>
-  include <abstractions/dbus-gtk>
   include <abstractions/dbus-session-strict>
   include <abstractions/dconf-write>
   include <abstractions/devices-usb>
@@ -36,10 +35,15 @@ profile vlc @{exec_path} {
   network inet6 stream,
   network netlink raw,
 
-  dbus send bus=session path=/org/freedesktop/DBus 
-       interface=org.freedesktop.DBus
-       member={RequestName,ReleaseName,GetConnectionUnixProcessID}
-       peer=(name=org.freedesktop.DBus),
+  dbus bind bus=session name=org.kde.StatusNotifierItem-*,
+
+  dbus bind bus=session name=org.mpris.MediaPlayer2.vlc*,
+  dbus (send, receive) bus=session path=/org/mpris/MediaPlayer2
+       interface=org.freedesktop.DBus.Properties
+       peer=(name="{org.freedesktop.DBus,:*}"), # all members
+  dbus (send, receive) bus=session path=/org/mpris/MediaPlayer2
+       interface=org.mpris.MediaPlayer2.*
+       peer=(name="{org.mpris.MediaPlayer2.vlc,org.freedesktop.DBus,:*}"), # all members
 
   dbus send bus=session path=/StatusNotifierWatcher
        interface=org.freedesktop.DBus.Introspectable
@@ -85,18 +89,6 @@ profile vlc @{exec_path} {
        interface=com.canonical.dbusmenu
        peer=(name=:*),
 
-  dbus (send, receive) bus=session path=/org/mpris/MediaPlayer2
-       interface=org.freedesktop.DBus.Properties
-       peer=(name="{org.freedesktop.DBus,:*}"), # all members
-
-  dbus (send, receive) bus=session path=/org/mpris/MediaPlayer2
-       interface=org.mpris.MediaPlayer2.*
-       peer=(name="{org.mpris.MediaPlayer2.vlc,org.freedesktop.DBus,:*}"), # all members
-
-  dbus bind bus=session name=org.kde.StatusNotifierItem-*,
-
-  dbus bind bus=session name=org.mpris.MediaPlayer2.vlc*,
-
   @{exec_path} mrix,
 
   @{bin}/xdg-screensaver rPx,

apparmor.d/profiles-s-z/wireplumber

@@ -23,6 +23,19 @@ profile wireplumber @{exec_path} {
 
   dbus bind bus=session name=org.freedesktop.ReserveDevice1.Audio0,
 
+  dbus send bus=system path=/org/freedesktop/RealtimeKit1
+       interface=org.freedesktop.RealtimeKit1
+       peer=(name=org.freedesktop.RealtimeKit1, label=rtkit-daemon),
+
+  dbus send bus=system path=/org/freedesktop/UPower/devices/DisplayDevice
+       interface=org.freedesktop.DBus.Properties
+       peer=(name=org.freedesktop.UPower, label=upowerd),
+
+  dbus send bus=system path=/org/freedesktop/RealtimeKit1
+       interface=org.freedesktop.DBus.Properties
+       member=Get
+       peer=(name=org.freedesktop.RealtimeKit1, label=rtkit-daemon),
+
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect

apparmor.d/profiles-s-z/wpa-supplicant

@@ -10,7 +10,8 @@ include <tunables/global>
 @{exec_path} = @{bin}/wpa_supplicant
 profile wpa-supplicant @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
-  include <abstractions/nameservice>
+  include <abstractions/dbus-strict>
+  include <abstractions/nameservice-strict>
   include <abstractions/openssl>
 
   capability chown,