refractor(profile): move org.gnome.SessionManager

This is the stage 1 of rewriting access to the session manager.

apparmor.d/abstractions/app/chromium

@@ -30,7 +30,7 @@
   include <abstractions/bus-system>
   include <abstractions/bus/org.freedesktop.FileManager1>
   include <abstractions/bus/org.gnome.Mutter.IdleMonitor>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/bus/system/org.bluez>
   include <abstractions/camera>
   include <abstractions/common/chromium>

apparmor.d/abstractions/bus/session/org.gnome.SessionManager

@@ -1,48 +1,46 @@
 # apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
-# FIXME: Too large, restrict it.
-
   abi <abi/4.0>,
 
-  #aa:dbus common bus=session name=org.gnome.SessionManager label=gnome-session-binary
+  #aa:dbus common bus=session name=org.gnome.SessionManager label="{gnome-session-binary,gnome-session-service}"
 
   dbus send bus=session path=/org/gnome/SessionManager
        interface=org.gnome.SessionManager
        member={RegisterClient,IsSessionRunning}
-       peer=(name="@{busname}", label=gnome-session-binary),
+       peer=(name="@{busname}", label="{gnome-session-binary,gnome-session-service}"),
 
   dbus send bus=session path=/org/gnome/SessionManager
        interface=org.gnome.SessionManager
        member={Inhibit,Uninhibit}
-       peer=(name="@{busname}", label=gnome-session-binary),
+       peer=(name="@{busname}", label="{gnome-session-binary,gnome-session-service}"),
 
   dbus send bus=session path=/org/gnome/SessionManager
        interface=org.gnome.SessionManager
        member={Setenv,IsSessionRunning}
-       peer=(name=org.gnome.SessionManager, label=gnome-session-binary),
+       peer=(name=org.gnome.SessionManager, label="{gnome-session-binary,gnome-session-service}"),
 
   dbus receive bus=session path=/org/gnome/SessionManager
        interface=org.gnome.SessionManager
        member={ClientAdded,ClientRemoved,SessionRunning,InhibitorRemoved,InhibitorAdded}
-       peer=(name="@{busname}", label=gnome-session-binary),
+       peer=(name="@{busname}", label="{gnome-session-binary,gnome-session-service}"),
 
   dbus send bus=session path=/org/gnome/SessionManager/Client@{int}
        interface=org.gnome.SessionManager.ClientPrivate
        member=EndSessionResponse
-       peer=(name="@{busname}", label=gnome-session-binary),
+       peer=(name="@{busname}", label="{gnome-session-binary,gnome-session-service}"),
 
   dbus receive bus=session path=/org/gnome/SessionManager/Client@{int}
        interface=org.gnome.SessionManager.ClientPrivate
        member={CancelEndSession,QueryEndSession,EndSession,Stop}
-       peer=(name="@{busname}", label=gnome-session-binary),
+       peer=(name="@{busname}", label="{gnome-session-binary,gnome-session-service}"),
 
   dbus receive bus=session path=/org/gnome/SessionManager/Presence
        interface=org.gnome.SessionManager.Presence
        member=StatusChanged
-       peer=(name="@{busname}", label=gnome-session-binary),
+       peer=(name="@{busname}", label="{gnome-session-binary,gnome-session-service}"),
 
-  include if exists <abstractions/bus/org.gnome.SessionManager.d>
+  include if exists <abstractions/bus/session/org.gnome.SessionManager.d>
 
 # vim:syntax=apparmor

apparmor.d/groups/bus/at-spi2-registryd

@@ -13,7 +13,7 @@ profile at-spi2-registryd @{exec_path} flags=(attach_disconnected) {
   include <abstractions/consoles>
   include <abstractions/bus-accessibility>
   include <abstractions/bus-session>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/X-strict>
 
   signal receive set=term peer=gdm,

apparmor.d/groups/bus/dbus-accessibility

@@ -12,7 +12,7 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus-accessibility>
   include <abstractions/bus-session>
   include <abstractions/bus/session/org.a11y>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/consoles>
   include <abstractions/dconf-write>
   include <abstractions/gschemas>

apparmor.d/groups/freedesktop/xdg-desktop-portal-gtk

@@ -14,7 +14,7 @@ profile xdg-desktop-portal-gtk @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus/org.freedesktop.Accounts>
   include <abstractions/bus/org.freedesktop.NetworkManager>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/bus/org.gnome.Shell.Introspect>
   include <abstractions/consoles>
   include <abstractions/dconf-write>

apparmor.d/groups/gnome/gnome-keyring-daemon

@@ -15,7 +15,7 @@ profile gnome-keyring-daemon @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus-system>
   include <abstractions/bus/org.freedesktop.login1.Session>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
 
   capability ipc_lock,
 

apparmor.d/groups/gnome/gsd-a11y-settings

@@ -10,7 +10,7 @@ include <tunables/global>
 profile gsd-a11y-settings @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus-session>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/consoles>
   include <abstractions/dconf-write>
   include <abstractions/gschemas>

apparmor.d/groups/gnome/gsd-color

@@ -13,7 +13,7 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus-session>
   include <abstractions/bus-system>
   include <abstractions/bus/org.gnome.Mutter.DisplayConfig>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/dconf-write>
   include <abstractions/fontconfig-cache-read>
   include <abstractions/gnome-strict>

apparmor.d/groups/gnome/gsd-datetime

@@ -10,7 +10,7 @@ include <tunables/global>
 profile gsd-datetime @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus-session>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/consoles>
   include <abstractions/dconf-write>
   include <abstractions/gschemas>

apparmor.d/groups/gnome/gsd-housekeeping

@@ -11,7 +11,7 @@ profile gsd-housekeeping @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/app-launcher-user>
   include <abstractions/bus-session>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/bus/session/org.freedesktop.systemd1>
   include <abstractions/consoles>
   include <abstractions/dconf-write>

apparmor.d/groups/gnome/gsd-keyboard

@@ -13,7 +13,7 @@ profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus-session>
   include <abstractions/bus-system>
   include <abstractions/bus/system/org.freedesktop.locale1>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/dconf-write>
   include <abstractions/fontconfig-cache-read>
   include <abstractions/gnome-strict>

apparmor.d/groups/gnome/gsd-media-keys

@@ -15,7 +15,7 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus/org.freedesktop.hostname1>
   include <abstractions/bus/org.freedesktop.login1>
   include <abstractions/bus/org.gnome.Mutter.IdleMonitor>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/bus/session/org.mpris.MediaPlayer2.Player>
   include <abstractions/consoles>
   include <abstractions/dconf-write>

apparmor.d/groups/gnome/gsd-power

@@ -19,7 +19,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus/org.freedesktop.systemd1>
   include <abstractions/bus/org.freedesktop.UPower.PowerProfiles>
   include <abstractions/bus/org.gnome.Mutter.IdleMonitor>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/consoles>
   include <abstractions/dconf-write>
   include <abstractions/fontconfig-cache-write>

apparmor.d/groups/gnome/gsd-print-notifications

@@ -11,7 +11,6 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus-session>
   include <abstractions/bus-system>
-  include <abstractions/bus/org.gnome.SessionManager>
   include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/bus/system/org.freedesktop.Avahi.RecordBrowser>
   include <abstractions/bus/system/org.freedesktop.Avahi.Server>

apparmor.d/groups/gnome/gsd-printer

@@ -9,10 +9,11 @@ include <tunables/global>
 @{exec_path} = @{lib}/gsd-printer
 profile gsd-printer @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
-  include <abstractions/consoles>
   include <abstractions/bus-session>
   include <abstractions/bus-system>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
+  include <abstractions/consoles>
   include <abstractions/nameservice-strict>
 
   signal (receive) set=(term, hup) peer=gdm*,

apparmor.d/groups/gnome/gsd-rfkill

@@ -15,7 +15,7 @@ profile gsd-rfkill @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus/org.freedesktop.hostname1>
   include <abstractions/bus/org.freedesktop.ModemManager1>
   include <abstractions/bus/org.freedesktop.NetworkManager>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
 
   signal (receive) set=(term, hup) peer=gdm*,
 

apparmor.d/groups/gnome/gsd-screensaver-proxy

@@ -11,7 +11,7 @@ profile gsd-screensaver-proxy @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/bus-session>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
 
   signal (receive) set=(term, hup) peer=gdm*,
 

apparmor.d/groups/gnome/gsd-sharing

@@ -12,7 +12,7 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus-session>
   include <abstractions/bus-system>
   include <abstractions/bus/org.freedesktop.NetworkManager>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/consoles>
   include <abstractions/dconf-write>
   include <abstractions/gschemas>

apparmor.d/groups/gnome/gsd-smartcard

@@ -10,7 +10,7 @@ include <tunables/global>
 profile gsd-smartcard @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus-session>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/consoles>
   include <abstractions/dconf-write>
   include <abstractions/gschemas>

apparmor.d/groups/gnome/gsd-sound

@@ -12,8 +12,8 @@ profile gsd-sound @{exec_path} flags=(attach_disconnected) {
   include <abstractions/consoles>
   include <abstractions/audio-client>
   include <abstractions/bus-session>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
-  include <abstractions/bus/org.gtk.vfs.MountTracker>
+  include <abstractions/bus/session/org.gtk.vfs.MountTracker>
   include <abstractions/dconf-write>
   include <abstractions/gschemas>
 

apparmor.d/groups/gnome/gsd-usb-protection

@@ -10,6 +10,9 @@ include <tunables/global>
 profile gsd-usb-protection @{exec_path} {
   include <abstractions/base>
   include <abstractions/bus-session>
+  include <abstractions/bus-system>
+  include <abstractions/bus/org.freedesktop.login1>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/dconf-write>
   include <abstractions/gschemas>
   include <abstractions/screensaver>

apparmor.d/groups/gnome/gsd-wacom

@@ -11,7 +11,7 @@ profile gsd-wacom @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
   include <abstractions/bus-session>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/dconf-write>
   include <abstractions/fontconfig-cache-write>
   include <abstractions/gnome-strict>

apparmor.d/groups/gnome/gsd-xsettings

@@ -13,10 +13,9 @@ profile gsd-xsettings @{exec_path} {
   include <abstractions/bus-system>
   include <abstractions/bus/org.freedesktop.Accounts>
   include <abstractions/bus/org.gnome.Mutter.DisplayConfig>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/bus/org.gnome.Shell.Introspect>
-  include <abstractions/bus/org.gtk.vfs.Daemon>
+  include <abstractions/bus/session/org.gtk.vfs.Daemon>
-  include <abstractions/bus/org.gtk.vfs.MountTracker>
   include <abstractions/dconf-write>
   include <abstractions/fontconfig-cache-read>
   include <abstractions/gnome-strict>

apparmor.d/groups/gnome/nautilus

@@ -15,7 +15,7 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus/org.freedesktop.hostname1>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
   include <abstractions/bus/org.freedesktop.Tracker3.Miner.Files>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/bus/session/org.gtk.Private.RemoteVolumeMonitor>
   include <abstractions/dconf-write>
   include <abstractions/deny-sensitive-home>

apparmor.d/groups/ubuntu/apport

@@ -11,7 +11,7 @@ profile apport @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/apt>
   include <abstractions/bus-session>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/nameservice-strict>
   include <abstractions/python>
 

apparmor.d/profiles-a-f/evince

@@ -12,7 +12,7 @@ profile evince @{exec_path} {
   include <abstractions/bus-session>
   include <abstractions/bus/org.freedesktop.FileManager1>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/dconf-write>
   include <abstractions/gnome-strict>
   include <abstractions/ibus>

apparmor.d/profiles-a-f/filezilla

@@ -11,7 +11,7 @@ include <tunables/global>
 profile filezilla @{exec_path} {
   include <abstractions/base>
   include <abstractions/bus-session>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/dconf-write>
   include <abstractions/desktop>
   include <abstractions/fontconfig-cache-read>

apparmor.d/profiles-a-f/freetube

@@ -17,7 +17,7 @@ include <tunables/global>
 profile freetube @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/audio-client>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/common/electron>
   include <abstractions/consoles>
   include <abstractions/screensaver>

apparmor.d/profiles-g-l/libreoffice

@@ -15,7 +15,7 @@ profile libreoffice @{exec_path} {
   include <abstractions/bus-session>
   include <abstractions/bus-system>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/bus/session/org.gtk.Private.RemoteVolumeMonitor>
   include <abstractions/bus/session/org.gtk.vfs.Daemon>
   include <abstractions/cups-client>

apparmor.d/profiles-s-z/superproductivity

@@ -20,7 +20,7 @@ profile superproductivity @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus/com.canonical.dbusmenu>
   include <abstractions/bus/org.freedesktop.portal.Desktop>
   include <abstractions/bus/org.gnome.Mutter.IdleMonitor>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/bus/session/org.freedesktop.portal.Settings>
   include <abstractions/bus/session/org.kde.StatusNotifierItem>
   include <abstractions/common/electron>

apparmor.d/profiles-s-z/totem

@@ -10,7 +10,7 @@ include <tunables/global>
 profile totem @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/audio-client>
-  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/bus/session/org.gnome.SessionManager>
   include <abstractions/common/gnome>
   include <abstractions/gstreamer>
   include <abstractions/screensaver>