Factorize.
Drop duplicate rules that are already covered by included abstractions.
Use the fonts abstraction.
Make rule more generic. There are more than one PID :)
Use the X abstraction.
Deduplicate tons of rules thanks to the gnome abstraction, that itself includes the base, fonts, X, freedesktop.org and user-tmp abstractions.
Deduplicate more rules provided by the base or gnome abstractions.
Grant the browser the right to play audio: it talks to pulseaudio and gstreamer.
Add more rules that Firefox needs.
Add (back) rules that are actually not covered by abstractions yet.

Going to fix that in upstream AppArmor abstractions.
Use the @{HOME} variable consistently.
Prefix all rules about @{HOME} with "owner", just in case.
Drop usage of @{pid} variable: it's not supported in any stable AppArmor release yet.
dash, grep and ps live in /bin/, not in /usr/bin/.
Add rule the launcher needs.
Adapt AppArmor profiles to match the drop of stable+alpha support.

(commit a26efed41)
Don't use the dconf abstraction yet: it's not part of any stable AppArmor release yet.
Drop Firefox privileges to (try to) play audio.

On a vaguely modern GNU/Linux distribution, PulseAudio is used to play sound on
the desktop. Given the TBB sets $HOME to its own directory, it doesn't find the
current user's existing instance of PulseAudio, and then tries to start its own.

Likely we don't want this to be allowed, in the context of these AppArmor
profiles:

* it's a pain to safely allow Firefox to run its own instance of PulseAudio;
* even if we managed to do it, it's not obvious to me that two concurrent
  isntances of PulseAudio, running as the same user, but now aware of the other,
  would work fine together in any useful way.

This can be revisited at a later point, but requires quite more work.
Give Firefox more privs it needs.
Comment out the "dbus" rule: it doesn't parse on any stable release of AppArmor yet.

One needs the upcoming AppArmor 2.9 userspace (or some Ubuntu's über-patched
snapshot of its development tree) to have this rule parse at all. And then, to
make it actually useful, one also needs to run a Linux kernel with patches that
have not been submitted to mainline yet.

In practice, with this change applied:

* Ubuntu users will need to un-comment this line, otherwise Firefox
  may disfunction.
* Basically all other users will be happy to see this profile actually loaded,
  and to see their TBB's Firefox be actually confined with AppArmor.

Once AppArmor 2.9 is available to most GNU/Linux users, this commit shall
be reverted.