Update totem and gstreamer profiles and abstractions
Merge of remote-tracking branch 'intrigeri/gnome-3.26', modified to:
- convert bwrap permission to scrub environment variables
- add permission to create (write) and read @{HOME}/.cache/totem/ as
pointed out by Vincas Dargis in the merge proposal.
Signed-off-by: Steve Beattie <email address hidden>
This is needed so Totem can kill bwrap processes it has spawned.
Once we confine bwrap we will need to adjust the peer= argument;
there's no way we forget as this signal rule won't match anymore,
so the denials this rule fixes right now will come back.
Totem abstraction: fix transition to gst_plugin_scanner profile.
Apparently the behavior of "Cix -> profile" has changed; I think it used to
(incorrectly?) accept to transition to a non-child profile whose name didn't
match the executable name, and now seems to be simply ignored. I'll consider
this as a bugfix. Let's use px instead, which works and matches more closely
what we want here.
Use pux instead of Pux for bwap, because it was original intention
(not to scrub $HOME which is needed). Also, Pux is deprecated and
produces aa-logprof error.
