diff --git a/apparmor.d/abstractions/bus/org.a11y b/apparmor.d/abstractions/bus/org.a11y
index 2677d2f61..c99f5f8bd 100644
--- a/apparmor.d/abstractions/bus/org.a11y
+++ b/apparmor.d/abstractions/bus/org.a11y
@@ -31,6 +31,11 @@
        member=Embed
        peer=(name=org.a11y.atspi.Registry, label="@{p_at_spi2_registryd}"),
 
+  dbus send bus=accessibility path=/org/a11y/atspi/accessible/root
+       interface=org.a11y.atspi.Socket
+       member=Embed
+       peer=(name=org.a11y.atspi.Registry),
+
   # Session bus
 
   dbus send bus=session path=/org/a11y/bus
@@ -38,6 +43,11 @@
        member=GetAll
        peer=(name=@{busname}, label="@{p_dbus_accessibility}"),
 
+  dbus send bus=session path=/org/a11y/bus
+       interface=org.freedesktop.DBus.Properties
+       member=Get
+       peer=(name=org.a11y.Bus, label="@{p_dbus_accessibility}"),
+
   dbus send bus=session path=/org/a11y/bus
        interface=org.a11y.Bus
        member=Get
diff --git a/apparmor.d/abstractions/graphics-full b/apparmor.d/abstractions/graphics-full
index 1f2b0ffd2..eb60edb4d 100644
--- a/apparmor.d/abstractions/graphics-full
+++ b/apparmor.d/abstractions/graphics-full
@@ -6,6 +6,10 @@
 
   include <abstractions/graphics>
 
+  @{sys}/devices/@{pci}/numa_node r,
+
+  @{PROC}/devices r,
+
   /dev/char/@{dynamic}:@{int} w,          # For dynamic assignment range 234 to 254, 384 to 511
   /dev/nvidia-uvm rw,
   /dev/nvidia-uvm-tools rw,
diff --git a/apparmor.d/abstractions/kde-strict b/apparmor.d/abstractions/kde-strict
index 428aa93f3..fd994d12d 100644
--- a/apparmor.d/abstractions/kde-strict
+++ b/apparmor.d/abstractions/kde-strict
@@ -20,6 +20,7 @@
   /usr/share/hwdata/*.ids r,
   /usr/share/icu/@{int}.@{int}/*.dat r,
   /usr/share/knotifications{5,6}/*.notifyrc r,
+  /usr/share/kubuntu-default-settings/{,**} r,  #aa:only ubuntu
 
   /etc/xdg/baloofilerc r,
   /etc/xdg/kcminputrc r,
@@ -44,7 +45,7 @@
   owner @{user_config_dirs}/menus/ r,
   owner @{user_config_dirs}/menus/applications-merged/ r,
   owner @{user_config_dirs}/session/ rw,
-  owner @{user_config_dirs}/session/@{profile_name}* rwlk,
+  owner @{user_config_dirs}/session/*_@{hex}_@{int}_@{int} rwlk,
   owner @{user_config_dirs}/session/#@{int} rw,
   owner @{user_config_dirs}/trashrc r,
 
diff --git a/apparmor.d/abstractions/mesa.d/complete b/apparmor.d/abstractions/mesa.d/complete
index 1d718c0b1..02a48114c 100644
--- a/apparmor.d/abstractions/mesa.d/complete
+++ b/apparmor.d/abstractions/mesa.d/complete
@@ -42,4 +42,6 @@
 
   @{PROC}/sys/dev/xe/observation_paranoid r,
 
+  /dev/udmabuf rw, # In upstream, but not released yet
+
 # vim:syntax=apparmor
diff --git a/apparmor.d/groups/apt/dpkg-script-linux b/apparmor.d/groups/apt/dpkg-script-linux
index b294b928b..af578be50 100644
--- a/apparmor.d/groups/apt/dpkg-script-linux
+++ b/apparmor.d/groups/apt/dpkg-script-linux
@@ -11,6 +11,8 @@ profile dpkg-script-linux @{exec_path} {
   include <abstractions/base>
   include <abstractions/common/debconf>
 
+  capability dac_read_search,
+
   @{exec_path} mrix,
 
   @{bin}/cat         ix,
diff --git a/apparmor.d/groups/apt/dpkg-scripts b/apparmor.d/groups/apt/dpkg-scripts
index 9be1f3258..7d2073768 100644
--- a/apparmor.d/groups/apt/dpkg-scripts
+++ b/apparmor.d/groups/apt/dpkg-scripts
@@ -168,6 +168,7 @@ profile dpkg-scripts @{exec_path} {
     /usr/local/ r,
     /usr/local/lib/ r,
 
+          /var/cache/ldconfig/ rw,
     owner /var/cache/ldconfig/aux-cache* rw,
 
     include if exists <local/dpkg-scripts_ldconfig>
diff --git a/apparmor.d/groups/apt/unattended-upgrade b/apparmor.d/groups/apt/unattended-upgrade
index 0d4d2ee33..d501a325f 100644
--- a/apparmor.d/groups/apt/unattended-upgrade
+++ b/apparmor.d/groups/apt/unattended-upgrade
@@ -52,9 +52,11 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
   @{bin}/touch                     ix,
   @{bin}/uname                     ix,
 
-  @{bin}/dpkg-deb                  px,
   @{bin}/apt-listchanges           Px,
+  @{bin}/df                        Px,
+  @{bin}/dmesg                     Px,
   @{bin}/dpkg                      Px,
+  @{bin}/dpkg-deb                  px,
   @{bin}/dpkg-divert               Px,
   @{bin}/etckeeper                 Px,
   @{bin}/ischroot                  Px,
@@ -90,7 +92,8 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
   /etc/pki/fwupd/{,**} r,
   /etc/profile.d/* r,
   /etc/ssh/moduli r,
-  /etc/ssh/ssh_config r,
+  @{etc_ro}/ssh/sshd_config r,
+  @{etc_ro}/ssh/sshd_config.d/{,*} r,
   /etc/ufw/{,**} r,
   /etc/update-manager/{,**} r,
   /etc/update-motd.d/{,**} r,
@@ -98,7 +101,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
   /etc/vmware-tools/{,**} r,
 
   /var/log/unattended-upgrades/{,**} rw,
-  /var/crash/*.crash w,
+  /var/crash/*.crash rw,
 
   /var/lib/apt/periodic/unattended-upgrades-stamp w,
   /var/lib/dpkg/info/{,*} r,
@@ -112,8 +115,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
   /var/lib/apt/lists/ rw,
   /var/lib/apt/lists/partial/ rw,
   /var/lib/apt/periodic/ w,
-  /var/log/apt/{term,history}.log w,
-  /var/log/apt/eipp.log.xz w,
+  /var/log/apt/*.log* rw,
 
         @{att}/@{run}/systemd/inhibit/@{int}.ref rw,
   owner @{run}/unattended-upgrades.lock rwk,
diff --git a/apparmor.d/groups/bluetooth/blueman-mechanism b/apparmor.d/groups/bluetooth/blueman-mechanism
index ffdda336e..9b4800210 100644
--- a/apparmor.d/groups/bluetooth/blueman-mechanism
+++ b/apparmor.d/groups/bluetooth/blueman-mechanism
@@ -11,6 +11,7 @@ include <tunables/global>
 profile blueman-mechanism @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus-system>
+  include <abstractions/fonts>
   include <abstractions/nameservice-strict>
   include <abstractions/python>
 
diff --git a/apparmor.d/groups/bluetooth/obexd b/apparmor.d/groups/bluetooth/obexd
index efb5f42e4..65ad4c0e5 100644
--- a/apparmor.d/groups/bluetooth/obexd
+++ b/apparmor.d/groups/bluetooth/obexd
@@ -10,8 +10,9 @@ include <tunables/global>
 @{exec_path} = @{lib}/bluetooth/obexd
 profile obexd @{exec_path} {
   include <abstractions/base>
-  include <abstractions/bus-system>
   include <abstractions/bus-session>
+  include <abstractions/bus-system>
+  include <abstractions/bus/ca.desrt.dconf.Writer>
   include <abstractions/user-download-strict>
 
   network bluetooth stream,
diff --git a/apparmor.d/groups/browsers/chromium-wrapper b/apparmor.d/groups/browsers/chromium-wrapper
index dea35ae1a..d29dcc630 100644
--- a/apparmor.d/groups/browsers/chromium-wrapper
+++ b/apparmor.d/groups/browsers/chromium-wrapper
@@ -45,6 +45,7 @@ profile chromium-wrapper @{exec_path} flags=(attach_disconnected) {
 
   # Silencer
   deny @{user_share_dirs}/gvfs-metadata/* r,
+  deny @{user_share_dirs}/gnome-shell/session.gvdb rw,
 
   include if exists <local/chromium-wrapper>
 }
diff --git a/apparmor.d/groups/browsers/firefox-glxtest b/apparmor.d/groups/browsers/firefox-glxtest
index 30281f2f4..f9470a59b 100644
--- a/apparmor.d/groups/browsers/firefox-glxtest
+++ b/apparmor.d/groups/browsers/firefox-glxtest
@@ -21,6 +21,8 @@ profile firefox-glxtest @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
+  / r,
+
   owner @{cache_dirs}/firefox/*/startupCache/scriptCache-* r,
   owner @{cache_dirs}/firefox/*/startupCache/startupCache* r,
 
diff --git a/apparmor.d/groups/bus/dbus-accessibility b/apparmor.d/groups/bus/dbus-accessibility
index ee787e4e1..f876d1210 100644
--- a/apparmor.d/groups/bus/dbus-accessibility
+++ b/apparmor.d/groups/bus/dbus-accessibility
@@ -23,8 +23,9 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) {
   network inet6 stream,
   network netlink raw,
 
-  signal (receive) set=(term hup kill) peer=dbus-session,
-  signal (receive) set=(term hup kill) peer=gdm{,-session-worker},
+  signal receive set=(term hup kill) peer=dbus-session,
+  signal receive set=(term hup kill) peer=gdm{,-session-worker},
+  signal receive set=(term hup kill) peer=gnome-session-binary,
 
   unix type=stream addr=none peer=(label=xorg, addr=@/tmp/.X11-unix/X0),
 
@@ -71,10 +72,10 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) {
   @{sys}/kernel/security/apparmor/features/dbus/mask r,
   @{sys}/module/apparmor/parameters/enabled r,
 
+        @{PROC}/@{pid}/cmdline r,
         @{PROC}/1/cgroup r,
   owner @{PROC}/@{pid}/attr/apparmor/current r,
   owner @{PROC}/@{pid}/cgroup r,
-  owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/fdinfo/@{int} r,
   owner @{PROC}/@{pid}/mounts r,
diff --git a/apparmor.d/groups/bus/ibus-memconf b/apparmor.d/groups/bus/ibus-memconf
index 803f28a4a..5233f8603 100644
--- a/apparmor.d/groups/bus/ibus-memconf
+++ b/apparmor.d/groups/bus/ibus-memconf
@@ -11,6 +11,7 @@ profile ibus-memconf @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus-session>
   include <abstractions/bus/org.gtk.vfs.MountTracker>
+  include <abstractions/consoles>
   include <abstractions/ibus>
   include <abstractions/nameservice-strict>
 
@@ -27,8 +28,6 @@ profile ibus-memconf @{exec_path} flags=(attach_disconnected) {
   owner @{desktop_config_dirs}/ibus/bus/ r,
   owner @{desktop_config_dirs}/ibus/bus/@{hex32}-unix-{,wayland-}@{int} r,
 
-  owner /dev/tty@{int} rw,
-
   include if exists <local/ibus-memconf>
 }
 
diff --git a/apparmor.d/groups/freedesktop/wireplumber b/apparmor.d/groups/freedesktop/wireplumber
index 25569cd68..80c3135f5 100644
--- a/apparmor.d/groups/freedesktop/wireplumber
+++ b/apparmor.d/groups/freedesktop/wireplumber
@@ -76,10 +76,8 @@ profile wireplumber @{exec_path} {
   @{sys}/devices/virtual/dmi/id/product_name r,
   @{sys}/devices/virtual/dmi/id/sys_vendor r,
 
-        @{PROC}/1/cgroup r,
-        @{PROC}/1/cmdline r,
-  owner @{PROC}/@{pid}/cgroup r,
-  owner @{PROC}/@{pid}/cmdline r,
+        @{PROC}/@{pid}/cgroup r,
+        @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,
 
   /dev/media@{int} rw,
diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal b/apparmor.d/groups/freedesktop/xdg-desktop-portal
index 5e27ac845..35c81f0bc 100644
--- a/apparmor.d/groups/freedesktop/xdg-desktop-portal
+++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal
@@ -45,6 +45,10 @@ profile xdg-desktop-portal @{exec_path} flags=(attach_disconnected) {
        interface=org.freedesktop.host.portal.Registry
        member=Register
        peer=(name=@{busname}),
+  dbus receive bus=session path=/org/freedesktop/portal/desktop
+       interface=org.freedesktop.portal.NetworkMonitor
+       member=GetStatus
+       peer=(name=@{busname}, label=snap.*),
 
   #aa:dbus own bus=session name=org.freedesktop.background.Monitor path=/org/freedesktop/background/monitor
 
diff --git a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome
index 6ee4cab6d..bed83627a 100644
--- a/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome
+++ b/apparmor.d/groups/freedesktop/xdg-desktop-portal-gnome
@@ -47,6 +47,10 @@ profile xdg-desktop-portal-gnome @{exec_path} flags=(attach_disconnected) {
        member=GetAll
        peer=(name=:*, label=gnome-shell),
 
+  dbus send bus=session path=/org/gnome/Shell
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=@{busname}, label=gnome-shell),
   dbus receive bus=session path=/org/gnome/Shell
        interface=org.freedesktop.DBus.Properties
        member=PropertiesChanged
diff --git a/apparmor.d/groups/freedesktop/xrandr b/apparmor.d/groups/freedesktop/xrandr
index fc1935c4b..ed9e7a030 100644
--- a/apparmor.d/groups/freedesktop/xrandr
+++ b/apparmor.d/groups/freedesktop/xrandr
@@ -12,8 +12,12 @@ profile xrandr @{exec_path} {
   include <abstractions/base>
   include <abstractions/X-strict>
 
+  capability dac_read_search,
+
   @{exec_path} mr,
 
+  @{run}/sddm/xauth_@{rand6} r,
+
   owner /dev/tty@{int} rw,
 
   include if exists <local/xrandr>
diff --git a/apparmor.d/groups/freedesktop/xwayland b/apparmor.d/groups/freedesktop/xwayland
index e8c94916d..a8950dbc6 100644
--- a/apparmor.d/groups/freedesktop/xwayland
+++ b/apparmor.d/groups/freedesktop/xwayland
@@ -20,7 +20,8 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
   signal (receive) set=(term hup) peer=kwin_wayland,
   signal (receive) set=(term hup) peer=login,
 
-  unix type=stream addr=none peer=(label=gnome-shell, addr=none),
+  unix type=stream peer=(label=gnome-shell),
+  unix type=stream peer=(label=kwin_wayland),
 
   @{exec_path} mrix,
 
diff --git a/apparmor.d/groups/gnome/deja-dup-monitor b/apparmor.d/groups/gnome/deja-dup-monitor
index af7fa51b0..ac5d6af81 100644
--- a/apparmor.d/groups/gnome/deja-dup-monitor
+++ b/apparmor.d/groups/gnome/deja-dup-monitor
@@ -33,10 +33,16 @@ profile deja-dup-monitor @{exec_path} {
        member=GetAll
        peer=(name=:*, label=NetworkManager),
 
+  dbus send bus=system path=/org/freedesktop/UPower/PowerProfiles
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=@{busname}, label=power-profiles-daemon),
+
   @{exec_path} mr,
 
   @{bin}/chrt       rix,
   @{bin}/ionice     rix,
+  @{bin}/deja-dup    Px,
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
diff --git a/apparmor.d/groups/gnome/gdm-generate-config b/apparmor.d/groups/gnome/gdm-generate-config
index d48b9eff6..9d910cdd2 100644
--- a/apparmor.d/groups/gnome/gdm-generate-config
+++ b/apparmor.d/groups/gnome/gdm-generate-config
@@ -18,7 +18,7 @@ profile gdm-generate-config @{exec_path} {
   capability setgid,
   capability setuid,
 
-  ptrace read,
+  # ptrace read,
 
   @{exec_path} mr,
 
@@ -45,7 +45,6 @@ profile gdm-generate-config @{exec_path} {
   @{PROC}/@{pid}/cgroup r,
   @{PROC}/@{pid}/cmdline r,
   @{PROC}/@{pid}/stat r,
-  @{PROC}/tty/drivers r,
   @{PROC}/uptime r,
 
   profile pgrep {
diff --git a/apparmor.d/groups/gnome/gjs-console b/apparmor.d/groups/gnome/gjs-console
index fdaa4e825..0cfd4c420 100644
--- a/apparmor.d/groups/gnome/gjs-console
+++ b/apparmor.d/groups/gnome/gjs-console
@@ -64,6 +64,7 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
   /usr/share/dconf/profile/gdm r,
   /usr/share/gdm/greeter-dconf-defaults r,
   /usr/share/gnome-shell/{,**} r,
+  /usr/share/thumbnailers/{,**} r,
 
   /tmp/ r,
   /var/tmp/ r,
@@ -76,9 +77,15 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
 
   owner @{HOME}/ r,
 
-  owner @{user_share_dirs}/gnome-shell/extensions/{,**} r,
   owner @{user_cache_dirs}/gstreamer-1.0/ rw,
   owner @{user_cache_dirs}/gstreamer-1.0/registry.*.bin{,.tmp@{rand6}} rw,
+  owner @{user_share_dirs}/gnome-shell/extensions/{,**} r,
+  owner @{user_share_dirs}/nautilus/scripts/ r,
+
+  owner @{user_desktop_dirs}/ r,
+  owner @{user_templates_dirs}/ r,
+
+  owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw,
 
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/fd/ r,
@@ -91,6 +98,8 @@ profile gjs-console @{exec_path} flags=(attach_disconnected) {
   /dev/ r,
   /dev/tty rw,
 
+  deny @{user_share_dirs}/gvfs-metadata/* r,
+
   include if exists <local/gjs-console>
 }
 
diff --git a/apparmor.d/groups/gnome/yelp b/apparmor.d/groups/gnome/yelp
index 058b9697a..1f2fc39d3 100644
--- a/apparmor.d/groups/gnome/yelp
+++ b/apparmor.d/groups/gnome/yelp
@@ -7,7 +7,7 @@ abi <abi/4.0>,
 include <tunables/global>
 
 @{exec_path} = @{bin}/yelp @{bin}/gnome-help
-profile yelp @{exec_path} {
+profile yelp @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/audio-client>
   include <abstractions/bus-system>
@@ -30,7 +30,9 @@ profile yelp @{exec_path} {
 
   /etc/xml/{,**} r,
 
-        @{sys}/devices/virtual/dmi/id/chassis_type r,
+  @{sys}/firmware/acpi/pm_profile r,
+  @{sys}/devices/virtual/dmi/id/chassis_type r,
+
         @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/app-gnome-yelp-*.scope/memory.* r,
   owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*.slice/*/memory.* r,
   owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/xdg-desktop-portal.service/memory.current r,
diff --git a/apparmor.d/groups/snap/snap b/apparmor.d/groups/snap/snap
index 425d5cd66..ef0a086a8 100644
--- a/apparmor.d/groups/snap/snap
+++ b/apparmor.d/groups/snap/snap
@@ -68,9 +68,13 @@ profile snap @{exec_path} flags=(attach_disconnected) {
   /var/cache/snapd/names r,
 
   @{DESKTOP_HOME}/snap/{,**} rw,
-  @{HOME}/snap/{,**} rw,
   /snap/{,**} rw,
 
+        @{HOME}/snap/{,**} rw,
+  owner @{HOME}/ r,
+  owner @{HOME}/.snap.mkdir-new/ rw,
+  owner @{HOME}/.snap/{,**} rw,
+
   owner @{tmp}/snapd-auto-import-mount-@{int}/ rw,
 
         @{run}/user/@{uid}/bus rw,
diff --git a/apparmor.d/groups/snap/snap-seccomp b/apparmor.d/groups/snap/snap-seccomp
index 7857bcc6a..9605c544a 100644
--- a/apparmor.d/groups/snap/snap-seccomp
+++ b/apparmor.d/groups/snap/snap-seccomp
@@ -9,7 +9,7 @@ include <tunables/global>
 @{lib_dirs} = @{lib}/ /snap/{snapd,core}/@{int}@{lib}
 
 @{exec_path} = @{lib_dirs}/snapd/snap-seccomp
-profile snap-seccomp @{exec_path} {
+profile snap-seccomp @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
diff --git a/apparmor.d/groups/snap/snapd b/apparmor.d/groups/snap/snapd
index 0f975b3b0..7e2c288b6 100644
--- a/apparmor.d/groups/snap/snapd
+++ b/apparmor.d/groups/snap/snapd
@@ -34,7 +34,6 @@ profile snapd @{exec_path} {
   capability setuid,
   capability sys_admin,
   capability sys_ptrace,
-  capability sys_resource,
 
   network inet stream,
   network inet6 stream,
diff --git a/apparmor.d/groups/ssh/sshd-session b/apparmor.d/groups/ssh/sshd-session
index e953834a7..ab86f3ad1 100644
--- a/apparmor.d/groups/ssh/sshd-session
+++ b/apparmor.d/groups/ssh/sshd-session
@@ -55,6 +55,7 @@ profile sshd-session @{exec_path} flags=(attach_disconnected) {
   @{exec_path} mr,
 
   @{bin}/@{shells}                   Ux, #aa:exclude RBAC
+  @{bin}/userdbctl                   Px,
   @{lib}/{openssh,ssh}/sshd-auth     Px,
 
   @{etc_rw}/motd r,
diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk
index 4940653a3..271ff23e4 100644
--- a/apparmor.d/groups/ubuntu/apport-gtk
+++ b/apparmor.d/groups/ubuntu/apport-gtk
@@ -29,10 +29,12 @@ profile apport-gtk @{exec_path} {
   network inet6 stream,
   network inet dgram,
   network inet6 dgram,
+  network netlink raw,
 
   @{exec_path} mr,
 
   @{sh_path}                    rix,
+  @{python_path}                rix,
   @{bin}/{f,}grep               rix,
   @{bin}/apt-cache              rPx,
   @{bin}/cut                    rix,
@@ -43,20 +45,24 @@ profile apport-gtk @{exec_path} {
   @{bin}/gsettings              rPx,
   @{bin}/ischroot               rPx,
   @{bin}/journalctl             rPx,
-  @{sbin}/killall5              rix,
   @{bin}/kmod                   rPx,
   @{bin}/ldd                    rix,
   @{bin}/lsb_release            rPx,
   @{bin}/md5sum                 rix,
   @{bin}/pkexec                 rCx -> pkexec,
+  @{bin}/readlink               rix,
   @{bin}/systemctl              rCx -> systemctl,
   @{bin}/systemd-detect-virt    rPx,
   @{bin}/uname                  rix,
   @{bin}/which{,.debianutils}   rix,
+  @{sbin}/killall5              rix,
   @{lib}/{,colord/}colord-sane  rPx,
   @{lib}/@{multiarch}/ld*.so*   rix,
   /usr/share/apport/root_info_wrapper rix,
 
+  @{bin}/* r,
+  @{sbin}/* r,
+
   /usr/share/apport/{,**} r,
   /usr/share/apport/general-hooks/*.py r,
 
@@ -79,9 +85,10 @@ profile apport-gtk @{exec_path} {
         /var/crash/ rw,
   owner /var/crash/*.@{uid}.{crash,upload} rw,
 
+  @{run}/cloud-init/cloud.cfg r,
   @{run}/snapd.socket rw,
 
-  owner @{tmp}/@{rand8} rw,
+  owner @{tmp}/@{word8} rw,
   owner @{tmp}/apport_core_@{rand8} rw,
   owner @{tmp}/launchpadlib.cache.@{rand8}/ rw,
   owner @{tmp}/tmp@{rand8}/{,**} rw,
@@ -135,6 +142,15 @@ profile apport-gtk @{exec_path} {
     include <abstractions/base>
     include <abstractions/app/systemctl>
 
+    dbus send bus=system path=/org/freedesktop/systemd1
+        interface=org.freedesktop.DBus.Properties
+        member=Get
+        peer=(name=org.freedesktop.systemd1, label=unconfined),
+    dbus send bus=system path=/org/freedesktop/systemd1
+        interface=org.freedesktop.systemd1.Manager
+        member=GetUnitFileState
+        peer=(name=org.freedesktop.systemd1, label=unconfined),
+
     include if exists <local/apport-gtk_systemctl>
   }
 
diff --git a/apparmor.d/groups/ubuntu/apt_news b/apparmor.d/groups/ubuntu/apt_news
index 7f4e8fbe2..9734803e4 100644
--- a/apparmor.d/groups/ubuntu/apt_news
+++ b/apparmor.d/groups/ubuntu/apt_news
@@ -14,6 +14,7 @@ profile apt_news @{exec_path} flags=(attach_disconnected) {
   include <abstractions/python>
 
   capability chown,
+  capability fowner,
   capability kill,
   capability setgid,
   capability setuid,
diff --git a/apparmor.d/groups/ubuntu/ubuntu-fan-net b/apparmor.d/groups/ubuntu/ubuntu-fan-net
index 74fe83551..ab83ebed4 100644
--- a/apparmor.d/groups/ubuntu/ubuntu-fan-net
+++ b/apparmor.d/groups/ubuntu/ubuntu-fan-net
@@ -14,10 +14,22 @@ profile ubuntu-fan-net @{exec_path} {
 
   @{sh_path}        mr,
   @{bin}/{m,g,}awk  ix,
+  @{bin}/kmod       Cx -> kmod,
   @{bin}/{,e}grep   ix,
   @{bin}/networkctl Px,
   @{sbin}/fanctl    Px,
 
+  profile kmod {
+    include <abstractions/base>
+    include <abstractions/app/kmod>
+
+    capability sys_module,
+
+    @{sys}/module/compression r,
+
+    include if exists <local/ubuntu-fan-net_kmod>
+  }
+
   include if exists <local/ubuntu-fan-net>
 }
 
diff --git a/apparmor.d/groups/ubuntu/update-notifier b/apparmor.d/groups/ubuntu/update-notifier
index 361290980..9754aa231 100644
--- a/apparmor.d/groups/ubuntu/update-notifier
+++ b/apparmor.d/groups/ubuntu/update-notifier
@@ -25,7 +25,7 @@ profile update-notifier @{exec_path} {
   unix (bind) type=stream addr=@@{udbus}/bus/systemd/bus-api-user,
 
   #aa:dbus talk bus=system name=org.debian.apt label=apt
-  #aa:dbus talk bus=session name=org.ayatana.NotificationItem label=gnome-shell
+  #aa:dbus talk bus=session name=org.ayatana.NotificationItem interface+=org.kde.StatusNotifierItem label=gnome-shell
 
   @{exec_path} mr,
 
diff --git a/apparmor.d/groups/ubuntu/update-notifier-crash b/apparmor.d/groups/ubuntu/update-notifier-crash
index d65c77a08..4926c0b1c 100644
--- a/apparmor.d/groups/ubuntu/update-notifier-crash
+++ b/apparmor.d/groups/ubuntu/update-notifier-crash
@@ -16,7 +16,7 @@ profile update-notifier-crash @{exec_path} {
   @{bin}/{,e}grep                       ix,
   @{bin}/groups                         Px,
   @{bin}/systemctl                      Cx -> systemctl,
-  @{bin}/which{,.debianutils}           ix,
+  @{bin}/which{,.debianutils}          rix,
   @{sh_path}                            mr,
   /usr/share/apport/apport-checkreports Px,
 
diff --git a/apparmor.d/groups/utils/login b/apparmor.d/groups/utils/login
index c35001498..cf9663e8e 100644
--- a/apparmor.d/groups/utils/login
+++ b/apparmor.d/groups/utils/login
@@ -54,6 +54,7 @@ profile login @{exec_path} flags=(attach_disconnected) {
   /etc/shells r,
 
   /var/lib/faillock/@{user} rwk,
+  /var/lib/lastlog/ r,
   /var/log/btmp{,.@{int}} r,
 
   owner @{user_cache_dirs}/motd.legal-displayed rw,
diff --git a/apparmor.d/groups/virt/cockpit-tls b/apparmor.d/groups/virt/cockpit-tls
index 7bf43ed4a..8a345588a 100644
--- a/apparmor.d/groups/virt/cockpit-tls
+++ b/apparmor.d/groups/virt/cockpit-tls
@@ -17,7 +17,7 @@ profile cockpit-tls @{exec_path} flags=(attach_disconnected) {
 
   /etc/cockpit/ws-certs.d/{,**} r,
 
-  @{att}/@{run}/cockpit/wsinstance/https@@{hex64}.sock r,
+  @{att}/@{run}/cockpit/wsinstance/https@@{hex64}.sock rw,
   @{att}/@{run}/cockpit/wsinstance/https-factory.sock rw,
 
   owner @{run}/cockpit/tls/{,**} rw,
diff --git a/apparmor.d/groups/virt/cockpit-wsinstance-factory b/apparmor.d/groups/virt/cockpit-wsinstance-factory
index 99db4d614..248ca43e8 100644
--- a/apparmor.d/groups/virt/cockpit-wsinstance-factory
+++ b/apparmor.d/groups/virt/cockpit-wsinstance-factory
@@ -11,12 +11,23 @@ profile cockpit-wsinstance-factory @{exec_path} {
   include <abstractions/base>
   include <abstractions/bus-system>
 
-  unix bind type=stream addr=@@{udbus}/bus/cockpit-wsinsta/system,
-
   capability net_admin,
 
+  unix bind type=stream addr=@@{udbus}/bus/cockpit-wsinsta/system,
+
+  dbus receive bus=system path=/org/freedesktop/systemd1
+       interface=org.freedesktop.systemd1.Manager
+       member=JobRemoved
+       peer=(name=@{busname}, label="@{p_systemd}"),
+  dbus send bus=system path=/org/freedesktop/systemd1
+       interface=org.freedesktop.systemd1.Manager
+       member=StartUnit
+       peer=(name=org.freedesktop.systemd1, label="@{p_systemd}"),
+
   @{exec_path} mr,
 
+  @{run}/cockpit/wsinstance/https-factory.sock w,
+
   include if exists <local/cockpit-wsinstance-factory>
 }
 
diff --git a/apparmor.d/profiles-a-f/dhclient-script b/apparmor.d/profiles-a-f/dhclient-script
index 3967512b8..9d84a4065 100644
--- a/apparmor.d/profiles-a-f/dhclient-script
+++ b/apparmor.d/profiles-a-f/dhclient-script
@@ -46,18 +46,18 @@ profile dhclient-script @{exec_path} {
   @{bin}/rm            rix,
   @{bin}/run-parts     rCx -> run-parts,
   @{bin}/sed           rix,
-  @{sbin}/sysctl       rix,
+  @{sbin}/sysctl       rCx -> sysctl,
   @{bin}/tr            rix,
   @{bin}/xxd           rix,
 
+  @{etc_rw}/resolv.conf rw,
+  @{etc_rw}/resolv.conf.dhclient-new.@{pid} rw,
+  @{etc_rw}/samba/dhcp.conf{,.new} rw,
   /etc/default/ddclient r,
   /etc/dhcp/{,**} r,
   /etc/fstab r,
   /etc/iproute2/rt_tables r,
   /etc/iproute2/rt_tables.d/{,*} r,
-  @{etc_rw}/resolv.conf rw,
-  @{etc_rw}/resolv.conf.dhclient-new.@{pid} rw,
-  @{etc_rw}/samba/dhcp.conf{,.new} rw,
 
   /var/lib/dhcp/dhclient.leases r,
   /var/lib/samba/dhcp.conf{,.new} rw,
@@ -71,7 +71,16 @@ profile dhclient-script @{exec_path} {
   @{sys}/devices/virtual/dmi/id/board_vendor r,
 
   owner @{PROC}/@{pid}/loginuid r,
-        @{PROC}/sys/net/ipv6/conf/*/stable_secret w,
+
+  profile sysctl {
+    include <abstractions/base>
+
+    @{sbin}/sysctl mr,
+
+    @{PROC}/sys/net/ipv6/conf/*/stable_secret w,
+
+    include if exists <local/dhclient-script_sysctl>
+  }
 
   profile run-parts {
     include <abstractions/base>
diff --git a/apparmor.d/profiles-a-f/dracut-install b/apparmor.d/profiles-a-f/dracut-install
index 6deb06eb6..e99760a73 100644
--- a/apparmor.d/profiles-a-f/dracut-install
+++ b/apparmor.d/profiles-a-f/dracut-install
@@ -13,6 +13,8 @@ profile dracut-install @{exec_path} {
 
   @{exec_path} mr,
 
+  @{bin}/cp rix,
+
   /etc/modprobe.d/{,**} r,
 
   @{sys}/devices/platform/{,**/} r,
diff --git a/apparmor.d/profiles-g-l/kernel b/apparmor.d/profiles-g-l/kernel
index 41098ab4b..c46b5556e 100644
--- a/apparmor.d/profiles-g-l/kernel
+++ b/apparmor.d/profiles-g-l/kernel
@@ -67,6 +67,10 @@ profile kernel @{exec_path} {
     include <abstractions/base>
     include <abstractions/app/kmod>
 
+    capability sys_module,
+
+    @{sys}/module/compression r,
+
     include if exists <local/kernel_kmod>
   }
 
diff --git a/apparmor.d/profiles-g-l/lsb-release b/apparmor.d/profiles-g-l/lsb-release
index 23bada3ec..d2d52d362 100644
--- a/apparmor.d/profiles-g-l/lsb-release
+++ b/apparmor.d/profiles-g-l/lsb-release
@@ -17,6 +17,7 @@ profile lsb-release @{exec_path} flags=(attach_disconnected) {
   @{exec_path} mr,
 
   @{sh_path}        rix,
+  @{bin}/           r,
   @{bin}/basename   rix,
   @{bin}/cat        rix,
   @{bin}/cut        rix,
diff --git a/apparmor.d/profiles-m-r/initramfs-hooks b/apparmor.d/profiles-m-r/initramfs-hooks
index a4fc278f0..cae5c1c3d 100644
--- a/apparmor.d/profiles-m-r/initramfs-hooks
+++ b/apparmor.d/profiles-m-r/initramfs-hooks
@@ -17,7 +17,7 @@ profile initramfs-hooks @{exec_path} {
   @{sh_path}                               rix,
   @{coreutils_path}                        rix,
   @{bin}/cpio                               ix,
-  @{bin}/dpkg                               Cx -> child-dpkg,
+  @{bin}/dpkg                               Px,
   @{bin}/fc-cache                           ix,
   @{bin}/ischroot                           Px,
   @{bin}/ldd                                Cx -> ldd,
diff --git a/apparmor.d/profiles-m-r/motd b/apparmor.d/profiles-m-r/motd
index 67f216212..6cdb0fbf8 100644
--- a/apparmor.d/profiles-m-r/motd
+++ b/apparmor.d/profiles-m-r/motd
@@ -9,9 +9,13 @@ include <tunables/global>
 @{exec_path} = /etc/update-motd.d/*
 profile motd @{exec_path} {
   include <abstractions/base>
+  include <abstractions/nameservice-strict>
 
   capability net_admin,
 
+  network inet6 stream,
+  network inet6 stream,
+
   @{exec_path} mr,
   @{bin}/ r,
 
@@ -44,7 +48,7 @@ profile motd @{exec_path} {
   /var/lib/ubuntu-advantage/messages/motd-esm-announce r,
   /var/lib/cloud/instances/nocloud/cloud-config.txt r,
 
-  # /tmp/tmp.@{rand10} rw,
+  /tmp/tmp.@{rand10} rw,
 
   @{run}/cloud-init/cloud.cfg r,
   @{run}/motd.d/{,*} r,
@@ -62,6 +66,8 @@ profile motd @{exec_path} {
     include <abstractions/nameservice-strict>
     include <abstractions/ssl_certs>
 
+    capability net_admin,
+
     network inet dgram,
     network inet stream,
     network inet6 dgram,
@@ -70,6 +76,8 @@ profile motd @{exec_path} {
 
     @{bin}/wget mr,
 
+    /etc/wgetrc r,
+
     /tmp/tmp.@{rand10} rw,
 
     include if exists <local/motd_wget>
diff --git a/apparmor.d/profiles-m-r/power-profiles-daemon b/apparmor.d/profiles-m-r/power-profiles-daemon
index b8f50ff7c..178bf28c6 100644
--- a/apparmor.d/profiles-m-r/power-profiles-daemon
+++ b/apparmor.d/profiles-m-r/power-profiles-daemon
@@ -38,10 +38,10 @@ profile power-profiles-daemon @{exec_path} flags=(attach_disconnected) {
   @{sys}/class/ r,
   @{sys}/class/drm/ r,
   @{sys}/class/power_supply/ r,
+  @{sys}/devices/**/status r,
   @{sys}/devices/**/power_supply/*/scope r,
   @{sys}/devices/**/uevent r,
   @{sys}/devices/system/cpu/*_pstate/{no_turbo,turbo_pct} r,
-  @{sys}/devices/system/cpu/*_pstate/status r,
   @{sys}/devices/system/cpu/cpu@{int}/power/energy_perf_bias rw,
   @{sys}/devices/system/cpu/cpufreq/ r,
   @{sys}/devices/system/cpu/cpufreq/policy@{int}/* rw,
diff --git a/apparmor.d/profiles-m-r/qdbus b/apparmor.d/profiles-m-r/qdbus
index fa67bad97..6816079ac 100644
--- a/apparmor.d/profiles-m-r/qdbus
+++ b/apparmor.d/profiles-m-r/qdbus
@@ -9,6 +9,7 @@ include <tunables/global>
 @{exec_path} = @{bin}/qdbus @{lib}/qt{5,6}/bin/qdbus
 profile qdbus @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus-session>
 
   @{exec_path} mr,
 
diff --git a/apparmor.d/profiles-s-z/switcheroo-control b/apparmor.d/profiles-s-z/switcheroo-control
index e1b9ab7de..eecb98b28 100644
--- a/apparmor.d/profiles-s-z/switcheroo-control
+++ b/apparmor.d/profiles-s-z/switcheroo-control
@@ -12,6 +12,7 @@ profile switcheroo-control @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus-system>
 
   capability net_admin,
+  capability sys_admin,
   capability sys_nice,
 
   network netlink raw,
diff --git a/apparmor.d/profiles-s-z/update-info-dir b/apparmor.d/profiles-s-z/update-info-dir
index 7c835023f..fe06b32af 100644
--- a/apparmor.d/profiles-s-z/update-info-dir
+++ b/apparmor.d/profiles-s-z/update-info-dir
@@ -18,6 +18,8 @@ profile update-info-dir @{exec_path} {
   @{bin}/find          ix,
   @{bin}/rm            ix,
 
+  /etc/environment r,
+
   include if exists <local/update-info-dir>
 }
 
diff --git a/apparmor.d/profiles-s-z/whoopsie b/apparmor.d/profiles-s-z/whoopsie
index 0c03f4a76..8a2c83904 100644
--- a/apparmor.d/profiles-s-z/whoopsie
+++ b/apparmor.d/profiles-s-z/whoopsie
@@ -10,10 +10,17 @@ include <tunables/global>
 profile whoopsie @{exec_path} {
   include <abstractions/base>
   include <abstractions/nameservice-strict>
+  include <abstractions/ssl_certs>
 
   capability setgid,
   capability setuid,
 
+  network inet dgram,
+  network inet stream,
+  network inet6 dgram,
+  network inet6 dgram,
+  network netlink raw,
+
   @{exec_path} mr,
 
   /var/crash/ r,
@@ -22,6 +29,9 @@ profile whoopsie @{exec_path} {
   /var/lib/whoopsie/whoopsie-id rw,
   /var/lib/whoopsie/whoopsie-id.@{rand6} rw,
 
+        /var/crash/*.@{uid}.crash r,
+  owner /var/crash/*.@{uid}.uploaded rw,
+
   owner @{run}/lock/whoopsie/ rw,
   owner @{run}/lock/whoopsie/lock rwk,
 
diff --git a/apparmor.d/profiles-s-z/wsdd b/apparmor.d/profiles-s-z/wsdd
index 20575b2a8..fc6955793 100644
--- a/apparmor.d/profiles-s-z/wsdd
+++ b/apparmor.d/profiles-s-z/wsdd
@@ -27,6 +27,7 @@ profile wsdd @{exec_path} {
 
   owner /var/lib/libuuid/clock.txt rw,
 
+        @{run}/uuidd/request rw,
   owner @{run}/user/@{uid}/gvfsd/wsdd w,
 
   include if exists <local/wsdd>
diff --git a/apparmor.d/profiles-s-z/xbrlapi b/apparmor.d/profiles-s-z/xbrlapi
index 4ce252e10..b2f94975f 100644
--- a/apparmor.d/profiles-s-z/xbrlapi
+++ b/apparmor.d/profiles-s-z/xbrlapi
@@ -16,6 +16,8 @@ profile xbrlapi @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
+  owner @{HOME}/.xsession-errors w,
+
   include if exists <local/xbrlapi>
 }