feat(dbus): rewrite some dbus rules (6).

apparmor.d/abstractions/bus/desktop

@@ -4,7 +4,7 @@
 
   dbus send bus=session path=/org/freedesktop/portal/desktop
        interface=org.freedesktop.DBus.Properties
-       member=Read
+       member={GetAll,Read}
        peer=(name="{:*,org.freedesktop.portal.Desktop}", label=xdg-desktop-portal),
 
   dbus send bus=session path=/org/freedesktop/portal/desktop

apparmor.d/abstractions/bus/notification

@@ -0,0 +1,10 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2023 Alexandre Pujol <[email protected]>
+# SPDX-License-Identifier: GPL-2.0-only
+
+  dbus send bus=session path=/org/freedesktop/Notifications
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=:*, label=gjs-console),
+
+  include if exists <abstractions/bus/notification.d>

apparmor.d/abstractions/bus/udisk

@@ -7,6 +7,11 @@
        member=GetManagedObjects
        peer=(name=:*, label=udisksd),
 
+  dbus send bus=system path=/org/freedesktop/UDisks2/**
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=:*, label=udisksd),
+
   dbus receive bus=system path=/org/freedesktop/UDisks2
        interface=org.freedesktop.DBus.ObjectManager
        member=InterfacesAdded

apparmor.d/groups/freedesktop/geoclue

@@ -20,13 +20,21 @@ profile geoclue @{exec_path} flags=(attach_disconnected) {
   network inet6 stream,
   network netlink raw,
 
-  dbus (send,receive) bus=system path=/org/freedesktop/GeoClue2/{Agent,Manager}
-       interface=org.freedesktop.{DBus.Properties,GeoClue2*},
+  dbus bind bus=system name=org.freedesktop.GeoClue2,
+  dbus send bus=system path=/org/freedesktop/GeoClue2/*
+       interface=org.freedesktop.DBus.Properties
+       peer=(name="{:*,org.freedesktop.DBus}"),
+  dbus receive bus=system path=/org/freedesktop/GeoClue2/*
+       interface=org.freedesktop.DBus.Properties
+       peer=(name=:*),
+  dbus receive bus=system path=/org/freedesktop/GeoClue2/*
+       interface=org.freedesktop.GeoClue2.Manager
+       peer=(name=:*),
 
   dbus send bus=system path=/org/freedesktop/DBus
        interface=org.freedesktop.DBus
-       member={GetConnectionUnixProcessID,GetConnectionUnixUser,ReleaseName,RequestName}
-       peer=(name=org.freedesktop.DBus),
+       member={GetConnectionUnixUser,GetConnectionUnixProcessID}
+       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
 
   dbus send bus=system path=/
        interface=org.freedesktop.Avahi.Server
@@ -36,9 +44,10 @@ profile geoclue @{exec_path} flags=(attach_disconnected) {
        interface=org.freedesktop.DBus.Peer
        member=Ping,
 
-  dbus send bus=system path=/fi/w[0-9]/wpa_supplicant[0-9]
+  dbus send bus=system path=/fi/w1/wpa_supplicant1
        interface=org.freedesktop.DBus.Properties
-       member=GetAll,
+       member=PropertiesChanged 
+       peer=(name=:*, label=wpa-supplicant),
 
   dbus send bus=system path=/org/freedesktop/ModemManager[0-9]
        interface=org.freedesktop.DBus.ObjectManager
@@ -65,9 +74,6 @@ profile geoclue @{exec_path} flags=(attach_disconnected) {
        interface=org.freedesktop.DBus.Properties
        member=PropertiesChanged,
 
-  dbus bind bus=system 
-       name=org.freedesktop.GeoClue2,
-
   @{exec_path} mr,
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,

apparmor.d/groups/gnome/gnome-extension-ding

@@ -10,6 +10,7 @@ include <tunables/global>
 profile gnome-extension-ding @{exec_path} {
   include <abstractions/base>
   include <abstractions/bus/atspi>
+  include <abstractions/bus/notification>
   include <abstractions/bus/vfs/daemon>
   include <abstractions/bus/vfs/metadata>
   include <abstractions/bus/vfs/mount>
@@ -44,10 +45,10 @@ profile gnome-extension-ding @{exec_path} {
        member=GetAll
        peer=(name=:*, label=nautilus),
 
-  dbus send bus=session path=/org/freedesktop/Notifications
+  dbus send bus=system path=/net/hadess/SwitcherooControl
        interface=org.freedesktop.DBus.Properties
        member=GetAll
-       peer=(name=:*, label=gjs-console),
+       peer=(name=:*, label=switcheroo-control),
 
   dbus send bus=session path=/org/gnome/Nautilus/FileOperations*
        interface=org.freedesktop.DBus.Properties
@@ -63,8 +64,11 @@ profile gnome-extension-ding @{exec_path} {
        member=Introspect
        peer=(name=:*, label=nautilus),
 
-  dbus send bus={systemd,session} path=/org/freedesktop/DBus
-       interface=org.freedesktop.DBus{,.Properties}
+  dbus send bus=session path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus*
+       peer=(name=org.freedesktop.DBus, label=dbus-daemon),
+  dbus send bus=system path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus*
        peer=(name=org.freedesktop.DBus, label=dbus-daemon),
 
   @{exec_path} mr,

apparmor.d/groups/gnome/gnome-session-ctl

@@ -18,7 +18,7 @@ profile gnome-session-ctl @{exec_path} {
   dbus send bus=session path=/org/freedesktop/systemd1
        interface=org.freedesktop.systemd1.Manager
        member={StartUnit,StopUnit}
-       peer=(name=org.freedesktop.systemd1),
+       peer=(name=org.freedesktop.systemd1, label="@{systemd}"),
 
   dbus send bus=session path=/org/gnome/SessionManager
        interface=org.gnome.SessionManager

apparmor.d/groups/gnome/gnome-shell

@@ -13,8 +13,11 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
   include <abstractions/audio>
   include <abstractions/bus/account-daemon>
   include <abstractions/bus/atspi>
+  include <abstractions/bus/desktop>
+  include <abstractions/bus/gnome-screensaver>
   include <abstractions/bus/network-manager>
   include <abstractions/bus/polkit>
+  include <abstractions/bus/session-manager>
   include <abstractions/bus/upower>
   include <abstractions/bus/vfs/metadata>
   include <abstractions/bus/vfs/mount>

apparmor.d/groups/gnome/gsd-color

@@ -10,6 +10,8 @@ include <tunables/global>
 profile gsd-color @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus/atspi>
+  include <abstractions/bus/session-manager>
+  include <abstractions/bus/vfs/mount>
   include <abstractions/dbus-accessibility-strict>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
@@ -23,6 +25,10 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
   signal (receive) set=(term, hup) peer=gdm*,
 
   dbus bind bus=session name=org.gnome.SettingsDaemon.Color,
+  dbus receive bus=session path=/org/gnome/SettingsDaemon/Color
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=:*, label=gnome-shell),
 
   dbus (send, receive) bus=system path=/org/freedesktop/ColorManager{,/devices/*}
        interface=org.freedesktop.ColorManager*,
@@ -31,36 +37,6 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
        interface=org.freedesktop.DBus.Properties
        member=GetAll,
 
-  dbus receive bus=session path=/org/gnome/SettingsDaemon/Color
-       interface=org.freedesktop.DBus.Properties
-       member=GetAll
-       peer=(name=:*, label=gnome-shell),
-
-  dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
-       interface=org.freedesktop.DBus.Properties
-       member={GetAll,PropertiesChanged}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member=EndSessionResponse
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member={CancelEndSession,QueryEndSession,EndSession,Stop}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member=RegisterClient
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
-       peer=(name=:*, label=gnome-session-binary),
-
   dbus send bus=session path=/org/gnome/Mutter/DisplayConfig
        interface=org.gnome.Mutter.DisplayConfig
        member={GetResources,GetCrtcGamma}
@@ -71,11 +47,6 @@ profile gsd-color @{exec_path} flags=(attach_disconnected) {
        member=GetAll
        peer=(name=:*, label=gnome-shell),
 
-  dbus send bus=session path=/org/gtk/vfs/mounttracker
-       interface=org.gtk.vfs.MountTracker
-       member=ListMountableInfo
-       peer=(name=:*, label=gvfsd),
-
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect

apparmor.d/groups/gnome/gsd-disk-utility-notify

@@ -1,5 +1,5 @@
 # apparmor.d - Full set of apparmor profiles
-# Copyright (C) 2021 Alexandre Pujol <[email protected]>
+# Copyright (C) 2021-2023 Alexandre Pujol <[email protected]>
 # SPDX-License-Identifier: GPL-2.0-only
 
 abi <abi/3.0>,
@@ -9,24 +9,17 @@ include <tunables/global>
 @{exec_path} = @{lib}/gsd-disk-utility-notify
 profile gsd-disk-utility-notify @{exec_path} {
   include <abstractions/base>
+  include <abstractions/bus/udisk>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
 
-  dbus receive bus=system path=/org/freedesktop/UDisks2{,/**}
-       interface=org.freedesktop.DBus.{Properties,ObjectManager},
-
-  dbus send bus=system path=/org/freedesktop/UDisks2
-       interface=org.freedesktop.DBus.ObjectManager
-       member=GetManagedObjects,
+  dbus bind bus=session name=org.gnome.Disks.NotificationMonitor,
 
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect 
        peer=(name=:*, label=gnome-shell),
 
-  dbus bind bus=session
-       name=org.gnome.Disks.NotificationMonitor,
-
   @{exec_path} mr,
 
   include if exists <local/gsd-disk-utility-notify>

apparmor.d/groups/gnome/gsd-keyboard

@@ -10,6 +10,7 @@ include <tunables/global>
 profile gsd-keyboard @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/bus/atspi>
+  include <abstractions/bus/locale>
   include <abstractions/bus/session-manager>
   include <abstractions/bus/vfs/mount>
   include <abstractions/dbus-accessibility-strict>

apparmor.d/groups/gnome/gsd-media-keys

@@ -13,6 +13,8 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus/atspi>
   include <abstractions/bus/hostname>
   include <abstractions/bus/login>
+  include <abstractions/bus/session-manager>
+  include <abstractions/bus/vfs/mount>
   include <abstractions/dbus-accessibility-strict>
   include <abstractions/dbus-session-strict>
   include <abstractions/dbus-strict>
@@ -40,31 +42,6 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
       member=GetAll
       peer=(name=:*, label=upowerd),
 
-  dbus (send, receive) bus=session path=/org/gnome/SessionManager{,/Client[0-9]*}
-       interface=org.freedesktop.DBus.Properties
-       member={GetAll,PropertiesChanged}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member=EndSessionResponse
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager/Client[0-9]*
-       interface=org.gnome.SessionManager.ClientPrivate
-       member={CancelEndSession,QueryEndSession,EndSession,Stop}
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus send bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member=RegisterClient
-       peer=(name=:*, label=gnome-session-binary),
-
-  dbus receive bus=session path=/org/gnome/SessionManager
-       interface=org.gnome.SessionManager
-       member={ClientAdded,SessionRunning,ClientRemoved,InhibitorRemoved,InhibitorAdded}
-       peer=(name=:*, label=gnome-session-binary),
-
   dbus send bus=session path=/org/gnome/Shell
        interface=org.freedesktop.DBus.Properties
        member=GetAll
@@ -110,11 +87,6 @@ profile gsd-media-keys @{exec_path} flags=(attach_disconnected) {
        member=WatchFired
        peer=(name=:*, label=gnome-shell),
 
-  dbus send bus=session path=/org/gtk/vfs/mounttracker
-       interface=org.gtk.vfs.MountTracker
-       member=ListMountableInfo
-       peer=(name=:*, label=gvfsd),
-
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable
        member=Introspect

apparmor.d/groups/gnome/gsd-power

@@ -13,6 +13,7 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus/atspi>
   include <abstractions/bus/gnome-screensaver>
   include <abstractions/bus/login>
+  include <abstractions/bus/session-manager>
   include <abstractions/bus/upower>
   include <abstractions/bus/vfs/mount>
   include <abstractions/dbus-accessibility-strict>
@@ -34,19 +35,6 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
        interface=org.freedesktop.DBus.Properties
        peer=(name="{org.freedesktop.DBus,:*}", label="{gsd-media-keys,gnome-shell}"),
 
-  dbus send bus=session path=/org/gnome/SessionManager{,/**}
-       interface=org.freedesktop.DBus.Properties
-       peer=(name=:*),
-  dbus send bus=session path=/org/gnome/SessionManager{,/**}
-       interface=org.gnome.SessionManager
-       peer=(name=:*),
-  dbus receive bus=session path=/org/gnome/SessionManager{,/**}
-       interface=org.gnome.SessionManager{,.*}
-       peer=(name=:*, label=gnome-session-binary),
-  dbus receive bus=session path=/org/gnome/SessionManager{,/**}
-       interface=org.freedesktop.DBus.Properties
-       peer=(name=:*, label=gnome-session-binary),
-
   dbus send bus=session path=/org/gnome/Mutter/**
        interface=org.freedesktop.DBus.{Properties,ObjectManager}
        peer=(name=:*, label=gnome-shell),
@@ -79,9 +67,14 @@ profile gsd-power @{exec_path} flags=(attach_disconnected) {
        member=GetAll
        peer=(name=:*, label=power-profiles-daemon),
 
-  dbus send bus=system path=/org/freedesktop/systemd1
+  dbus send bus=system path=/org/freedesktop/login1/session/auto
        interface=org.freedesktop.DBus.Properties
-       peer=(name=org.freedesktop.systemd1, label="@{systemd}"),
+       member=GetAll
+       peer=(name=:*, label=systemd-logind),
+  dbus send bus=system path=/org/freedesktop/login1/session/auto
+       interface=org.freedesktop.login1.Session
+       member=SetBrightness
+       peer=(name=:*, label=systemd-logind),
 
   dbus receive bus=session
        interface=org.freedesktop.DBus.Introspectable