Steve, the snap_browsers abstractions needed an update because the abstraction had not been updated in an year and the snap browsers now required read and lock permissions to the file /var/lib/snapd/inhibit/{browser-name}.lock, but this was also submitted, approved and merged upstream: https://gitlab.com/apparmor/apparmor/-/merge_requests/1045
Regarding the patch for evince, I kept the "Recommends" because, yes, the include if exists checks if the abstraction is present and it only includes in the case it is, but the actual rule which references the snap_browsers profile could fail for apparmor versions for which snap_browsers does not exist.
/{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/bin/snap mrCx -> snap_browsers,
Steve, the snap_browsers abstractions needed an update because the abstraction had not been updated in an year and the snap browsers now required read and lock permissions to the file /var/lib/ snapd/inhibit/ {browser- name}.lock, but this was also submitted, approved and merged upstream: https:/ /gitlab. com/apparmor/ apparmor/ -/merge_ requests/ 1045
Regarding the patch for evince, I kept the "Recommends" because, yes, the include if exists checks if the abstraction is present and it only includes in the case it is, but the actual rule which references the snap_browsers profile could fail for apparmor versions for which snap_browsers does not exist. core/[0- 9]*/,snap/ snapd/[ 0-9]*/} usr/bin/ snap mrCx -> snap_browsers,
/{,snap/