general_initial

apparmor.d/groups/gnome/gnome-keyring-daemon

@@ -29,7 +29,7 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
        member=Get
        peer=(name=org.freedesktop.login[0-9]),
 
-  dbus receive bus=system path=/org/freedesktop/login[0-9]/session/_[0-9]*
+  dbus receive bus=system path=/org/freedesktop/login[0-9]/session/*
        interface=org.freedesktop.DBus.Properties
        member=PropertiesChanged
        peer=(name=:*, label=systemd-logind),
@@ -41,8 +41,7 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
 
   dbus (send, receive) bus=session path=/org/gnome/keyring/daemon
        interface=org.gnome.keyring.Daemon
-       member=GetControlDirectory
-       peer=(name="{org.gnome.keyring,:*}", label=gnome-keyring-daemon), # itself
+       peer=(name="{org.gnome.keyring,:*}", label=@{profile_name}), # all members
 
   dbus receive bus=session path=/org/freedesktop/secrets
        interface=org.freedesktop.DBus.Properties
@@ -54,6 +53,41 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
        member=SearchItems
        peer=(name=:*, label=gnome-shell),
 
+  dbus receive bus=session path=/org/freedesktop/secrets/aliases/default
+       interface=org.freedesktop.Secret.Collection
+       member=CreateItem
+       peer=(name=:*),
+
+  dbus receive bus=session path=/org/freedesktop/secrets/aliases/default
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=:*),
+
+  dbus send bus=session path=/org/freedesktop/secrets/collection/login
+       interface=org.freedesktop.Secret.Collection
+       member=ItemCreated
+       peer=(name=org.freedesktop.DBus),
+
+  dbus send bus=session path=/org/freedesktop/secrets/collection/login
+       interface=org.freedesktop.DBus.Properties
+       member=PropertiesChanged
+       peer=(name=org.freedesktop.DBus),
+
+  dbus receive bus=session path=/org/freedesktop/secrets
+       interface=org.freedesktop.Secret.Service
+       member={ReadAlias,OpenSession}
+       peer=(name=:*),
+
+  dbus receive bus=session path=/org/freedesktop/secrets/collection/login/[0-9]*
+       interface=org.freedesktop.Secret.Item
+       member=GetSecret
+       peer=(name=:*),
+
+  dbus receive bus=session path=/org/freedesktop/secrets{,/collection/**}
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=:*),
+
   dbus receive bus=session path=/org/freedesktop/portal/desktop
        interface=org.freedesktop.DBus.Properties
        member=GetAll
@@ -64,6 +98,11 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
        member=Introspect
        peer=(name=:*, label=gnome-shell),
 
+  dbus receive bus=session path=/org/freedesktop/secrets
+       interface=org.freedesktop.Secret.Service
+       member={GetSecrets,SearchItems}
+       peer=(name=:*), # label="{unconfined,remmina}"),
+
   dbus bind bus=session
        name=org.gnome.keyring,
 
@@ -88,6 +127,7 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
 
   owner @{HOME}/.local/ w,
   owner @{HOME}/.local/share/ w,
+  owner @{HOME}/.xsession-errors w,
 
   owner @{run}/user/@{uid}/keyring/ rw,
   owner @{run}/user/@{uid}/keyring/* rw,

apparmor.d/groups/gnome/tracker-extract

@@ -18,6 +18,7 @@ profile tracker-extract @{exec_path} {
   include <abstractions/opencl-nvidia>
   include <abstractions/openssl>
   include <abstractions/X-strict>
+  include <abstractions/freedesktop.org>
 
   network netlink raw,
 
@@ -28,20 +29,22 @@ profile tracker-extract @{exec_path} {
        member={RequestName,ReleaseName}
        peer=(name=org.freedesktop.DBus, label=dbus-daemon),
 
-  dbus send bus=session path=/org/freedesktop/Tracker3/Endpoint
+  dbus send    bus=session path=/org/freedesktop/Tracker3/Endpoint
        interface=org.freedesktop.DBus.Peer
        member=Ping
        peer=(name=org.freedesktop.Tracker3.Miner.Files),
 
   dbus send    bus=session path=/org/freedesktop/Tracker3/Endpoint
        interface=org.freedesktop.Tracker3.Endpoint
-       member=Query
-       peer=(name=org.freedesktop.Tracker3.Miner.Files, label=tracker-miner),
+       peer=(name=org.freedesktop.Tracker3.Miner.Files, label=tracker-miner), # all members
 
   dbus receive bus=session path=/org/freedesktop/Tracker3/Endpoint
        interface=org.freedesktop.Tracker3.Endpoint
-       member=GraphUpdated
-       peer=(name=:*, label=tracker-miner),
+       peer=(name=:*, label=tracker-miner), # all members
+
+  dbus send    bus=session path=/org/freedesktop/Tracker3/Miner/**
+       interface=org.freedesktop.Tracker3.Miner
+       peer=(name=org.freedesktop.DBus, label=tracker-miner), # all members
 
   dbus send bus=session path=/org/gtk/vfs/mounttracker
        interface=org.gtk.vfs.MountTracker
@@ -63,8 +66,6 @@ profile tracker-extract @{exec_path} {
 
   @{exec_path} mr,
 
-  /usr/share/applications/*.desktop r,
-  /usr/share/applications/mimeinfo.cache r,
   /usr/share/dconf/profile/gdm r,
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
   /usr/share/hwdata/*.ids r,
@@ -85,6 +86,8 @@ profile tracker-extract @{exec_path} {
   /var/lib/gdm{3,}/.cache/gstreamer-1.0/registry.*.bin{,.tmp*} rw,
   /var/lib/gdm{3,}/greeter-dconf-defaults r,
 
+  /var/lib/lightdm/.cache/gstreamer-1.0/registry.*.bin{,.tmp??????} r,
+
   /var/lib/flatpak/exports/share/applications/mimeinfo.cache r,
   /var/lib/flatpak/exports/share/mime/mime.cache r,
   /var/lib/snapd/desktop/applications/*.desktop r,

apparmor.d/groups/gnome/tracker-miner

@@ -58,12 +58,14 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
 
   dbus send    bus=session path=/org/freedesktop/Tracker3/Endpoint
        interface=org.freedesktop.Tracker3.Endpoint
-       member=GraphUpdated
-       peer=(name=org.freedesktop.DBus, label=tracker-extract),
+       peer=(name=org.freedesktop.DBus, label=tracker-extract), # all members
 
   dbus receive bus=session path=/org/freedesktop/Tracker3/Endpoint
        interface=org.freedesktop.Tracker3.Endpoint
-       member=Query
+       peer=(name=:*, label=tracker-extract), # all members
+
+  dbus receive bus=session path=/org/freedesktop/Tracker3/Miner/**
+       interface=org.freedesktop.Tracker3.Miner
        peer=(name=:*, label=tracker-extract),
 
   dbus receive bus=session path=/{,org}
@@ -82,7 +84,6 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
   /usr/share/gvfs/remote-volume-monitors/{,*.monitor} r,
   /usr/share/tracker3-miners/{,**} r,
   /usr/share/tracker3/{,**} r,
-  /usr/share/ubuntu/applications/ r,
 
   /etc/fstab r,
 
@@ -94,6 +95,10 @@ profile tracker-miner @{exec_path} flags=(attach_disconnected) {
   /var/lib/gdm{3,}/.local/share/applications/ r,
   /var/lib/gdm{3,}/greeter-dconf-defaults r,
 
+  /var/lib/lightdm/.config/dconf/user r,
+  /var/lib/lightdm/.cache/tracker3/files/meta.db{,-wal} rwk,
+  /var/lib/lightdm/.cache/tracker3/files/no-need-mtime-check.txt{,.??????} rw,
+
   owner /var/tmp/etilqs_@{hex} rw,
 
   # Allow to search user files