diff --git a/apparmor.d/groups/gvfs/gvfsd-sftp b/apparmor.d/groups/gvfs/gvfsd-sftp
index cabee57c2..157af621c 100644
--- a/apparmor.d/groups/gvfs/gvfsd-sftp
+++ b/apparmor.d/groups/gvfs/gvfsd-sftp
@@ -19,6 +19,7 @@ profile gvfsd-sftp @{exec_path} {
   @{bin}/ssh  rPx,
 
   owner @{run}/user/@{uid}/gvfsd-sftp/ rw,
+  owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} w,
 
   owner @{PROC}/@{pid}/fd/ r,
 
diff --git a/apparmor.d/groups/pacman/mkinitcpio b/apparmor.d/groups/pacman/mkinitcpio
index ed91f6c9c..8c92421f1 100644
--- a/apparmor.d/groups/pacman/mkinitcpio
+++ b/apparmor.d/groups/pacman/mkinitcpio
@@ -49,6 +49,7 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) {
   @{bin}/plymouth            rPx,
   @{bin}/plymouth-set-default-theme rPx,
   @{bin}/sbctl               rPx,
+  @{bin}/sync                rPx,
 
   @{lib}/initcpio/busybox    rix,
   @{lib}/initcpio/post/**    rix,
diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman
index 16a8171ca..327af130f 100644
--- a/apparmor.d/groups/pacman/pacman
+++ b/apparmor.d/groups/pacman/pacman
@@ -135,8 +135,8 @@ profile pacman @{exec_path} flags=(attach_disconnected) {
         @{PROC}/@{pids}/ r,
         @{PROC}/@{pids}/cgroup r,
         @{PROC}/@{pids}/cmdline r,
+        @{PROC}/@{pids}/environ r,
         @{PROC}/@{pids}/stat r,
-        @{PROC}/1/environ r,
         @{PROC}/sys/kernel/osrelease r,
         @{PROC}/tty/drivers r,
         @{PROC}/uptime r,
diff --git a/apparmor.d/groups/procps/htop b/apparmor.d/groups/procps/htop
index 08b58ebd2..c720929f3 100644
--- a/apparmor.d/groups/procps/htop
+++ b/apparmor.d/groups/procps/htop
@@ -20,10 +20,10 @@ profile htop @{exec_path} {
 
   network netlink raw,
 
-  signal (send),
-  signal (receive) set=(hup) peer=gnome-terminal-server,
+  signal send,
+  signal receive set=hup peer=gnome-terminal-server,
 
-  ptrace (read),
+  ptrace read,
 
   @{exec_path} mr,
 
@@ -38,51 +38,6 @@ profile htop @{exec_path} {
   owner @{user_config_dirs}/htop/ rw,
   owner @{user_config_dirs}/htop/* rw,
 
-  owner @{PROC}/@{pid}/smaps_rollup r,
-
-  @{PROC}/ r,
-  @{PROC}/diskstats r,
-  @{PROC}/loadavg r,
-  @{PROC}/pressure/cpu r,
-  @{PROC}/pressure/io r,
-  @{PROC}/pressure/memory r,
-  @{PROC}/sys/kernel/osrelease r,
-  @{PROC}/sys/kernel/pid_max r,
-  @{PROC}/sys/kernel/sched_autogroup_enabled r,
-  @{PROC}/tty/drivers r,
-  @{PROC}/uptime r,
-
-  @{PROC}/@{pids}/ r,
-  @{PROC}/@{pids}/attr/current r,
-  @{PROC}/@{pids}/autogroup rw,
-  @{PROC}/@{pids}/cgroup r,
-  @{PROC}/@{pids}/cmdline r,
-  @{PROC}/@{pids}/comm r,
-  @{PROC}/@{pids}/environ r,
-  @{PROC}/@{pids}/io r,
-  @{PROC}/@{pids}/mounts r,
-  @{PROC}/@{pids}/net/dev r,
-  @{PROC}/@{pids}/oom_{,score_}adj r,
-  @{PROC}/@{pids}/oom_score r,
-  @{PROC}/@{pids}/stat r,
-  @{PROC}/@{pids}/statm r,
-  @{PROC}/@{pids}/wchan r,
-
-  @{PROC}/@{pids}/task/ r,
-  @{PROC}/@{pids}/task/@{tid}/ r,
-  @{PROC}/@{pids}/task/@{tid}/attr/current r,
-  @{PROC}/@{pids}/task/@{tid}/cgroup r,
-  @{PROC}/@{pids}/task/@{tid}/cmdline r,
-  @{PROC}/@{pids}/task/@{tid}/comm r,
-  @{PROC}/@{pids}/task/@{tid}/environ r,
-  @{PROC}/@{pids}/task/@{tid}/io r,
-  @{PROC}/@{pids}/task/@{tid}/oom_{,score_}adj r,
-  @{PROC}/@{pids}/task/@{tid}/oom_score r,
-  @{PROC}/@{pids}/task/@{tid}/stat r,
-  @{PROC}/@{pids}/task/@{tid}/statm r,
-  @{PROC}/@{pids}/task/@{tid}/status r,
-  @{PROC}/@{pids}/task/@{tid}/wchan r,
-
   @{sys}/bus/dax/devices/ r,
   @{sys}/bus/i2c/devices/ r,
   @{sys}/bus/soc/devices/ r,
@@ -129,8 +84,52 @@ profile htop @{exec_path} {
   @{sys}/kernel/mm/hugepages/ r,
   @{sys}/kernel/mm/hugepages/hugepages-*/nr_hugepages r,
 
+  @{PROC}/ r,
+  @{PROC}/diskstats r,
+  @{PROC}/loadavg r,
+  @{PROC}/pressure/cpu r,
+  @{PROC}/pressure/io r,
+  @{PROC}/pressure/memory r,
+  @{PROC}/sys/kernel/osrelease r,
+  @{PROC}/sys/kernel/pid_max r,
+  @{PROC}/sys/kernel/sched_autogroup_enabled r,
+  @{PROC}/tty/drivers r,
+  @{PROC}/uptime r,
+
+  @{PROC}/@{pids}/ r,
+  @{PROC}/@{pids}/attr/current r,
+  @{PROC}/@{pids}/autogroup rw,
+  @{PROC}/@{pids}/cgroup r,
+  @{PROC}/@{pids}/cmdline r,
+  @{PROC}/@{pids}/comm r,
+  @{PROC}/@{pids}/environ r,
+  @{PROC}/@{pids}/io r,
+  @{PROC}/@{pids}/mounts r,
+  @{PROC}/@{pids}/net/dev r,
+  @{PROC}/@{pids}/oom_{,score_}adj r,
+  @{PROC}/@{pids}/oom_score r,
+  @{PROC}/@{pids}/stat r,
+  @{PROC}/@{pids}/statm r,
+  @{PROC}/@{pids}/wchan r,
+
+  @{PROC}/@{pids}/task/ r,
+  @{PROC}/@{pids}/task/@{tid}/ r,
+  @{PROC}/@{pids}/task/@{tid}/attr/current r,
+  @{PROC}/@{pids}/task/@{tid}/cgroup r,
+  @{PROC}/@{pids}/task/@{tid}/cmdline r,
+  @{PROC}/@{pids}/task/@{tid}/comm r,
+  @{PROC}/@{pids}/task/@{tid}/environ r,
+  @{PROC}/@{pids}/task/@{tid}/io r,
+  @{PROC}/@{pids}/task/@{tid}/oom_{,score_}adj r,
+  @{PROC}/@{pids}/task/@{tid}/oom_score r,
+  @{PROC}/@{pids}/task/@{tid}/stat r,
+  @{PROC}/@{pids}/task/@{tid}/statm r,
+  @{PROC}/@{pids}/task/@{tid}/status r,
+  @{PROC}/@{pids}/task/@{tid}/wchan r,
+
         @{PROC}/cmdline r,
   owner @{PROC}/@{pid}/cpuset r,
+  owner @{PROC}/@{pid}/smaps_rollup r,
 
   /dev/tty@{int} rw,
 
diff --git a/apparmor.d/groups/procps/uptime b/apparmor.d/groups/procps/uptime
index 904ebe415..3da204a38 100644
--- a/apparmor.d/groups/procps/uptime
+++ b/apparmor.d/groups/procps/uptime
@@ -15,6 +15,8 @@ profile uptime @{exec_path} {
 
   @{exec_path} mr,
 
+  @{run}/systemd/sessions/@{int} r,
+
   @{PROC}/uptime r,
   @{PROC}/loadavg r,
   @{PROC}/sys/kernel/osrelease r,
diff --git a/apparmor.d/groups/ssh/ssh b/apparmor.d/groups/ssh/ssh
index 69f594f7a..0c86919b1 100644
--- a/apparmor.d/groups/ssh/ssh
+++ b/apparmor.d/groups/ssh/ssh
@@ -13,19 +13,20 @@ profile ssh @{exec_path} {
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
 
-  signal (receive) set=(term) peer=gnome-keyring-daemon,
-
   network inet stream,
   network inet6 stream,
   network inet dgram,
   network inet6 dgram,
   network netlink raw,
 
+  signal receive set=term peer=gnome-keyring-daemon,
+  signal send set=hup peer=unconfined,
+
   @{exec_path} mrix,
 
   @{bin}/@{shells}     rUx,
 
-  @{lib}/ssh/ssh-sk-helper rPx -> ssh-sk-helper,
+  @{lib}/{,ssh/}ssh-sk-helper rPx,
 
   @{etc_ro}/ssh/ssh_config r,
   @{etc_ro}/ssh/ssh_config.d/{,*} r,
@@ -42,8 +43,9 @@ profile ssh @{exec_path} {
   owner @{user_projects_dirs}/**/ssh/{,*} r,
   owner @{user_projects_dirs}/**/config r,
 
-  owner @{tmp}/ssh-*/{,agent.@{int}} rwkl,
+  audit owner @{tmp}/ssh-*/{,agent.@{int}} rwkl,
 
+  owner @{run}/user/@{uid}/gvfsd-sftp/@{hex}.@{hex16} rwl -> @{run}/user/@{uid}/gvfsd-sftp/@{hex}.@{hex16},
   owner @{run}/user/@{uid}/keyring/ssh rw,
 
   owner @{PROC}/@{pid}/loginuid r,
diff --git a/apparmor.d/groups/ssh/ssh-sk-helper b/apparmor.d/groups/ssh/ssh-sk-helper
index d913e2a2d..c8c29dbaf 100644
--- a/apparmor.d/groups/ssh/ssh-sk-helper
+++ b/apparmor.d/groups/ssh/ssh-sk-helper
@@ -6,7 +6,7 @@ abi <abi/4.0>,
 
 include <tunables/global>
 
-@{exec_path} = @{lib}/ssh/ssh-sk-helper
+@{exec_path} = @{lib}/{,ssh/}ssh-sk-helper
 profile ssh-sk-helper flags=(complain) {
   include <abstractions/base>
 
diff --git a/apparmor.d/groups/systemd/busctl b/apparmor.d/groups/systemd/busctl
index 826405d2d..765758771 100644
--- a/apparmor.d/groups/systemd/busctl
+++ b/apparmor.d/groups/systemd/busctl
@@ -20,11 +20,11 @@ profile busctl @{exec_path} flags=(attach_disconnected) {
   capability net_admin,
   capability sys_ptrace,
 
-  ptrace (read),
+  ptrace read,
 
-  unix (bind) type=stream addr=@@{udbus}/bus/busctl/busctl,
+  unix bind type=stream addr=@@{udbus}/bus/busctl/busctl,
 
-  signal (send) set=(cont) peer=child-pager,
+  signal send set=cont peer=child-pager,
 
   dbus eavesdrop bus=accessibility,
   dbus eavesdrop bus=session,
diff --git a/apparmor.d/groups/systemd/systemd-analyze b/apparmor.d/groups/systemd/systemd-analyze
index 039f8dc64..7310586e8 100644
--- a/apparmor.d/groups/systemd/systemd-analyze
+++ b/apparmor.d/groups/systemd/systemd-analyze
@@ -61,6 +61,7 @@ profile systemd-analyze @{exec_path} {
   @{sys}/firmware/efi/efivars/LoaderTimeExecUSec-@{uuid} r,
 
         @{PROC}/swaps r,
+        @{PROC}/sys/fs/nr_open r,
   owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/comm r,
   owner @{PROC}/@{pid}/mountinfo r,
diff --git a/apparmor.d/profiles-s-z/spotify b/apparmor.d/profiles-s-z/spotify
index 41219a4f8..ef516a7d6 100644
--- a/apparmor.d/profiles-s-z/spotify
+++ b/apparmor.d/profiles-s-z/spotify
@@ -44,9 +44,10 @@ profile spotify @{exec_path} flags=(attach_disconnected) {
 
   owner @{tmp}/.org.chromium.Chromium.@{rand6}/** rw,
 
-        @{PROC}/pressure/* r,
         @{PROC}/@{pid}/net/unix r,
+        @{PROC}/pressure/* r,
   owner @{PROC}/@{pid}/clear_refs w,
+  owner @{PROC}/@{pid}/task/@{tid}/comm rw,
 
   /dev/tty rw,
 
diff --git a/apparmor.d/profiles-s-z/transmission b/apparmor.d/profiles-s-z/transmission
index 2a39981df..ad219f1ab 100644
--- a/apparmor.d/profiles-s-z/transmission
+++ b/apparmor.d/profiles-s-z/transmission
@@ -59,6 +59,7 @@ profile transmission @{exec_path} flags=(attach_disconnected) {
   owner @{PROC}/@{pid}/comm r,
   owner @{PROC}/@{pid}/mountinfo r,
   owner @{PROC}/@{pid}/mounts r,
+  owner @{PROC}/@{pid}/stat r,
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,
 
   deny @{user_share_dirs}/gvfs-metadata/* r,
diff --git a/apparmor.d/profiles-s-z/wpa-cli b/apparmor.d/profiles-s-z/wpa-cli
index c9987fa01..3920a21df 100644
--- a/apparmor.d/profiles-s-z/wpa-cli
+++ b/apparmor.d/profiles-s-z/wpa-cli
@@ -13,7 +13,7 @@ profile wpa-cli @{exec_path} {
 
   @{exec_path} mr,
 
-  /{usr/,}{s,}/wpa_action rPx,
+  @{bin}/wpa_action rPx,
 
   /etc/inputrc r,