feat(profile): improve dbus rule in the gnome profiles.

apparmor.d/groups/gnome/deja-dup-monitor

@@ -23,6 +23,11 @@ profile deja-dup-monitor @{exec_path} {
   #aa:dbus own bus=session name=org.gnome.DejaDup.Monitor
   #aa:dbus talk bus=session name=org.gnome.DejaDup interface+=org.gtk.Actions label=deja-dup
 
+  dbus send bus=session path=/org/gnome/DejaDup
+       interface=org.gtk.Actions
+       member=Activate
+       peer=(name=org.gnome.DejaDup),
+
   dbus send bus=system path=/org/freedesktop/NetworkManager
        interface=org.freedesktop.DBus.Properties
        member=GetAll
@@ -30,6 +35,9 @@ profile deja-dup-monitor @{exec_path} {
 
   @{exec_path} mr,
 
+  @{bin}/chrt       rix,
+  @{bin}/ionice     rix,
+
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
   /var/tmp/ r,

apparmor.d/groups/gnome/evolution-calendar-factory

@@ -57,11 +57,6 @@ profile evolution-calendar-factory @{exec_path} {
        member=Complete
        peer=(name=org.freedesktop.DBus, label=gnome-calendar),
 
-  dbus send bus=session path=/org/gtk/vfs/metadata
-       interface=org.gtk.vfs.Metadata
-       member=Move
-       peer=(name=:*, label=gvfsd-metadata),
-
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect

apparmor.d/groups/gnome/gdm-session-worker

@@ -50,7 +50,7 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
   unix bind type=stream addr=@@{udbus}/bus/gdm-session-wor/system,
 
   #aa:dbus talk bus=system name=org.freedesktop.Accounts label=accounts-daemon
-  #aa:dbus talk bus=system name=org.freedesktop.home1.Manager label=systemd-homed
+  #aa:dbus talk bus=system name=org.freedesktop.home1 interface=org.freedesktop.home1.Manager label=systemd-homed
 
   dbus send bus=system path=/org/freedesktop/login1
        interface=org.freedesktop.login1.Manager

apparmor.d/groups/gnome/gnome-calendar

@@ -14,6 +14,7 @@ profile gnome-calendar @{exec_path} {
   include <abstractions/bus/org.freedesktop.NetworkManager>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
   include <abstractions/bus/org.freedesktop.timedate1>
+  include <abstractions/bus/org.gtk.vfs.MountTracker>
   include <abstractions/common/gnome>
   include <abstractions/nameservice-strict>
   include <abstractions/p11-kit>
@@ -22,6 +23,7 @@ profile gnome-calendar @{exec_path} {
   network netlink raw,
 
   #aa:dbus own bus=session name=org.gnome.Calendar
+  #aa-dbus own bus=session name=org.gnome.Calendar.SearchProvider interface+=org.gnome.Shell.SearchProvider2
 
   #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.AddressBook@{int} label=evolution-addressbook-factory
   #aa:dbus talk bus=session name=org.gnome.evolution.dataserver.Calendar@{int} label=evolution-calendar-factory

apparmor.d/groups/gnome/gnome-characters

@@ -11,11 +11,13 @@ profile gnome-characters @{exec_path} {
   include <abstractions/base>
   include <abstractions/bus-system>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
+  include <abstractions/bus/org.gtk.vfs.MountTracker>
   include <abstractions/common/gnome>
   include <abstractions/fontconfig-cache-read>
   include <abstractions/nameservice-strict>
 
-  #aa:dbus own bus=session name=org.gnome.Characters interface+=org.gnome.Shell.SearchProvider2
+  #aa:dbus own bus=session name=org.gnome.Characters
+  #aa-dbus own bus=session name=org.gnome.Characters.SearchProvider interface+=org.gnome.Shell.SearchProvider2
 
   @{exec_path} mr,
 

apparmor.d/groups/gnome/gnome-clocks

@@ -20,6 +20,7 @@ profile gnome-clocks @{exec_path} {
   network netlink raw,
 
   #aa:dbus own bus=session name=org.gnome.clocks interface+=org.gtk.Actions
+  #aa:dbus own bus=session name=org.gnome.clocks.SearchProvider interface+=org.gnome.Shell.SearchProvider2
 
   @{exec_path} mr,
   @{open_path}  rPx -> child-open-help,

apparmor.d/groups/gnome/gnome-control-center-search-provider

@@ -10,11 +10,12 @@ include <tunables/global>
 profile gnome-control-center-search-provider @{exec_path} {
   include <abstractions/base>
   include <abstractions/bus-session>
+  include <abstractions/bus/org.gtk.vfs.MountTracker>
   include <abstractions/dconf-write>
   include <abstractions/gnome-strict>
   include <abstractions/graphics>
 
-  #aa:dbus own bus=session name=org.gnome.Settings.SearchProvider
+  #aa:dbus own bus=session name=org.gnome.Settings.SearchProvider interface+=org.gnome.Shell.SearchProvider2
 
   @{exec_path} mr,
 

apparmor.d/groups/gnome/gnome-initial-setup

@@ -31,6 +31,11 @@ profile gnome-initial-setup @{exec_path} {
 
   #aa:dbus own bus=session name=org.gnome.InitialSetup interface+=org.gtk.Actions
 
+  dbus send bus=system path=/com/canonical/UbuntuAdvantage/Manager
+       interface=org.freedesktop.DBus.Properties
+       member=Get
+       peer=(name=com.canonical.UbuntuAdvantage),
+
   @{exec_path} mr,
 
   @{bin}/df      rPx,

apparmor.d/groups/gnome/gnome-session

@@ -28,6 +28,7 @@ profile gnome-session @{exec_path} {
   @{bin}/manpath               rix,
   @{bin}/readlink              rix,
   @{bin}/realpath              rix,
+  @{bin}/run-parts             rix,
   @{bin}/sed                   rix,
   @{bin}/tput                  rix,
   @{bin}/tr                    rix,

apparmor.d/groups/gnome/gnome-shell

@@ -75,6 +75,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
   #aa:dbus own bus=session name=com.canonical.{U,u}nity
   #aa:dbus own bus=session name=com.rastersoft.dingextension
   #aa:dbus own bus=session name=org.ayatana.NotificationItem
+  #aa:dbus own bus=session name=org.freedesktop.a11y.Manager
   #aa:dbus own bus=session name=org.gtk.Actions path=/**
   #aa:dbus own bus=session name=org.gtk.MountOperationHandler
   #aa:dbus own bus=session name=org.gtk.Notifications
@@ -90,10 +91,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
 
   #aa:dbus talk bus=session name=com.rastersoft.ding label=gnome-extension-ding
   #aa:dbus talk bus=session name=org.gnome.* label=gnome-*
+  #aa:dbus talk bus=session name=org.gnome.*.SearchProvider interface+=org.gnome.Shell.SearchProvider2 label="*"
+  #aa:dbus talk bus=session name=org.gnome.Nautilus label=nautilus
   #aa:dbus talk bus=session name=org.gnome.ScreenSaver label=gjs-console
   #aa:dbus talk bus=session name=org.gnome.SettingsDaemon.* label=gsd-*
   #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}"
-  #aa:dbus talk bus=session name=org.gnome.Nautilus label=nautilus
 
   # System bus
 
@@ -113,6 +115,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
 
   # Session bus
 
+  dbus send bus=session path=/org/gnome/**
+       peer=(name=org.gnome.*),
+
   dbus send bus=session path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus.Properties
        member=GetAll
@@ -373,7 +378,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
 
     capability sys_ptrace,
 
-    ptrace (read),
+    ptrace read,
 
     @{sh_path} mr,
 

apparmor.d/groups/gnome/gsd-housekeeping

@@ -10,10 +10,11 @@ include <tunables/global>
 profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/app-launcher-user>
-  include <abstractions/consoles>
   include <abstractions/bus-session>
+  include <abstractions/bus/org.freedesktop.systemd1-session>
   include <abstractions/bus/org.gnome.SessionManager>
   include <abstractions/bus/org.gtk.vfs.MountTracker>
+  include <abstractions/consoles>
   include <abstractions/dconf-write>
   include <abstractions/gnome-strict>
   include <abstractions/thumbnails-cache-write>

apparmor.d/groups/gnome/gsd-power

@@ -9,7 +9,6 @@ include <tunables/global>
 @{exec_path} = @{lib}/gsd-power
 profile gsd-power @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
-  include <abstractions/consoles>
   include <abstractions/audio-client>
   include <abstractions/bus-accessibility>
   include <abstractions/bus-session>
@@ -20,11 +19,13 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus/org.freedesktop.login1.Session>
   include <abstractions/bus/org.freedesktop.login1>
   include <abstractions/bus/org.freedesktop.systemd1>
+  include <abstractions/bus/org.freedesktop.UPower.PowerProfiles>
   include <abstractions/bus/org.freedesktop.UPower>
   include <abstractions/bus/org.gnome.Mutter.IdleMonitor>
   include <abstractions/bus/org.gnome.ScreenSaver>
   include <abstractions/bus/org.gnome.SessionManager>
   include <abstractions/bus/org.gtk.vfs.MountTracker>
+  include <abstractions/consoles>
   include <abstractions/dconf-write>
   include <abstractions/fontconfig-cache-write>
   include <abstractions/gnome-strict>

apparmor.d/groups/gnome/localsearch

@@ -26,6 +26,7 @@ profile localsearch @{exec_path} flags=(attach_disconnected) {
 
   network netlink raw,
 
+  #aa:dbus own bus=session name=org.freedesktop.Tracker3.Miner.Files
   #aa:dbus own bus=session name=org.freedesktop.LocalSearch3
 
   @{exec_path} mr,
@@ -61,6 +62,7 @@ profile localsearch @{exec_path} flags=(attach_disconnected) {
         @{PROC}/sys/fs/inotify/max_user_watches r,
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/mountinfo r,
+  owner @{PROC}/@{pid}/mounts r,
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,
 
   /dev/media@{int} rw,

apparmor.d/groups/gnome/nautilus

@@ -28,8 +28,9 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
 
   mqueue r type=posix /,
 
-  #aa:dbus own bus=session name=org.gnome.Nautilus interface+="org.gtk.{Application,Actions}"
   #aa:dbus own bus=session name=org.freedesktop.FileManager1
+  #aa:dbus own bus=session name=org.gnome.Nautilus interface+="org.gtk.{Application,Actions}"
+  #aa:dbus own bus=session name=org.gnome.Nautilus.SearchProvider interface+=org.gnome.Shell.SearchProvider2
 
   #aa:dbus talk bus=session name=org.gtk.MountOperationHandler label=gnome-shell
   #aa:dbus talk bus=session name=org.gtk.vfs label="gvfsd{,-*}"

apparmor.d/groups/gnome/seahorse

@@ -16,12 +16,13 @@ profile seahorse @{exec_path} {
   include <abstractions/bus/org.freedesktop.Avahi>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
   include <abstractions/bus/org.freedesktop.secrets>
+  include <abstractions/bus/org.gtk.vfs.MountTracker>
   include <abstractions/dconf-write>
   include <abstractions/gnome-strict>
   include <abstractions/p11-kit>
   include <abstractions/ssl_certs>
 
-  #aa:dbus own bus=session name=org.gnome.seahorse.Application
+  #aa:dbus own bus=session name=org.gnome.seahorse.Application interface+=org.gnome.Shell.SearchProvider2
 
   @{exec_path} mr,
 

apparmor.d/groups/gvfs/gvfsd-network

@@ -18,27 +18,27 @@ profile gvfsd-network @{exec_path} {
   dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
        interface=org.gtk.vfs.Spawner
        member=Spawned
-       peer=(name=:*, label=gvfsd),
+       peer=(name="@{busname}", label=gvfsd),
 
   dbus receive bus=session path=/org/gtk/vfs/mountable
        interface=org.gtk.vfs.Mountable
        member=Mount
-       peer=(name=:*, label=gvfsd),
+       peer=(name="@{busname}", label=gvfsd),
 
   dbus send bus=session path=/org/gtk/vfs/mounttracker
        interface=org.gtk.vfs.MountTracker
        member={MountLocation,LookupMount,RegisterMount}
-       peer=(name=:*, label=gvfsd),
+       peer=(name="@{busname}", label=gvfsd),
 
   dbus send bus=session path=/org/gtk/vfs/Daemon
        interface=org.gtk.vfs.Daemon
        member=GetConnection
-       peer=(name=:*, label=gvfsd-dnssd),
+       peer=(name="@{busname}", label=gvfsd-dnssd),
 
   dbus receive bus=session path=/org/gtk/vfs/Daemon
        interface=org.gtk.vfs.Daemon
        member=GetConnection
-       peer=(name=:*, label=gnome-control-center),
+       peer=(name="@{busname}", label=gnome-control-center),
 
   @{exec_path} mr,
 

apparmor.d/groups/gvfs/gvfsd-recent

@@ -23,15 +23,15 @@ profile gvfsd-recent @{exec_path} {
   dbus receive bus=session path=/org/gtk/vfs/mountable
        interface=org.gtk.vfs.Mountable
        member=Mount
-       peer=(name=:*, label=gvfsd),
+       peer=(name="@{busname}", label=gvfsd),
   dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
        interface=org.gtk.vfs.Spawner
        member=Spawned
-       peer=(name=:*, label=gvfsd),
+       peer=(name="@{busname}", label=gvfsd),
   dbus send bus=session path=/org/gtk/vfs/mounttracker
        interface=org.gtk.vfs.MountTracker
        member=RegisterMount
-       peer=(name=:*, label=gvfsd),
+       peer=(name="@{busname}", label=gvfsd),
 
   @{exec_path} mr,
 

apparmor.d/groups/gvfs/gvfsd-smb-browse

@@ -26,12 +26,12 @@ profile gvfsd-smb-browse @{exec_path} {
   dbus receive bus=session path=/org/gtk/vfs/mountable
        interface=org.gtk.vfs.Mountable
        member=Mount
-       peer=(name=:*, label=gvfsd),
+       peer=(name="@{busname}", label=gvfsd),
 
   dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
        interface=org.gtk.vfs.Spawner
        member=Spawned
-       peer=(name=:*, label=gvfsd),
+       peer=(name="@{busname}", label=gvfsd),
 
   @{exec_path} mr,
 

apparmor.d/groups/gvfs/gvfsd-trash

@@ -24,27 +24,27 @@ profile gvfsd-trash @{exec_path} {
   dbus receive bus=session path=/org/gtk/vfs/Daemon
        interface=org.gtk.vfs.Daemon
        member=GetConnection
-       peer=(name=:*, label="{gnome-shell,nautilus}"),
+       peer=(name="@{busname}", label="{gnome-shell,nautilus}"),
 
   dbus receive bus=session path=/org/gtk/vfs/mountable
        interface=org.gtk.vfs.Mountable
        member=Mount
-       peer=(name=:*, label=gvfsd),
+       peer=(name="@{busname}", label=gvfsd),
 
   dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
        interface=org.gtk.vfs.Spawner
        member=Spawned
-       peer=(name=:*, label=gvfsd),
+       peer=(name="@{busname}", label=gvfsd),
 
   dbus send bus=session path=/org/gtk/vfs/mounttracker
        interface=org.gtk.vfs.MountTracker
        member=RegisterMount
-       peer=(name=:*, label=gvfsd),
+       peer=(name="@{busname}", label=gvfsd),
 
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect
-       peer=(name=:*, label=gnome-shell),
+       peer=(name="@{busname}", label=gnome-shell),
 
   @{exec_path} mr,
 

apparmor.d/groups/gvfs/gvfsd-wsdd

@@ -10,11 +10,25 @@ include <tunables/global>
 profile gvfsd-wsdd @{exec_path} {
   include <abstractions/base>
   include <abstractions/bus-session>
+  include <abstractions/bus-system>
+  include <abstractions/bus/org.gtk.vfs.MountTracker>
 
   network netlink raw,
 
   #aa:dbus own bus=session name=org.gtk.vfs.mountpoint_wsdd
-  #aa:dbus talk bus=session name=org.gtk.vfs.MountTracker label=gvfsd
+
+  dbus receive bus=session path=/org/gtk/vfs/mountable
+       interface=org.gtk.vfs.Mountable
+       member=Mount
+       peer=(name="@{busname}", label=gvfsd),
+  dbus send bus=session path=/org/gtk/gvfs/exec_spaw/@{int}
+       interface=org.gtk.vfs.Spawner
+       member=Spawned
+       peer=(name="@{busname}", label=gvfsd),
+  dbus send bus=session path=/org/gtk/vfs/mounttracker
+       interface=org.gtk.vfs.MountTracker
+       member=RegisterMount
+       peer=(name="@{busname}", label=gvfsd),
 
   @{exec_path} mr,
 
@@ -23,6 +37,7 @@ profile gvfsd-wsdd @{exec_path} {
 
         @{run}/mount/utab r,
   owner @{run}/user/@{uid}/gvfsd/socket-@{rand8} rw,
+  owner @{run}/user/@{uid}/gvfsd/wsdd rw,
 
   include if exists <local/gvfsd-wsdd>
 }