Confused about network rules

[SomeoneWhoUsesGit]

I want to add deny network,
to okular and libreoffice but upon doing so it crashes the app and it will not work anymore. Both of the profiles used are from this project, only change I made was a local override of deny network,

I assumed they did not need internet
unless it is local sockets maybe?

I added audit deny network, to both to see what is denied and okular shows:

DENIED okular create info="failed af match" comm=okular family=unix sock_type=stream protocol=0 requested_mask=create denied_mask=create error=-13 addr=none
DENIED okular create info="failed af match" comm=okular family=unix sock_type=dgram protocol=0 requested_mask=create denied_mask=create addr=none error=-13
DENIED okular create info="failed af match" comm=QDBusConnection family=unix sock_type=stream protocol=0 requested_mask=create denied_mask=create error=-13 addr=none

libreoffice shows:

DENIED libreoffice create info="failed af match" comm=oosplash family=unix sock_type=stream protocol=0 requested_mask=create denied_mask=create addr=none error=-13
DENIED libreoffice create info="failed af match" comm=osl_executeProc family=unix sock_type=stream protocol=0 requested_mask=create denied_mask=create addr=none error=-13

I am somewhat confused by what exactly is being denied here, would appreciate some help,

thanks

[roddhjav]

These are unix rules. You always have local unix socket connection established across various services in most (all) UI app. Thus, you need to narrow your deny rules a bit.

• In this specific example, some are needed to allow communication over Dbus.
• Some of these rule are even in the base abstraction:
  

  apparmor.d/apparmor.d/abstractions/base-strict

  Lines 88 to 89 in 7f94eda

  	# Allow us to create abstract and anonymous sockets
  	unix create,

[SomeoneWhoUsesGit]

oh I see, that makes sense.
I have tried narrowing it down to more external web requests permissions so far I have

deny network inet dgram,
deny network inet6 dgram,
deny network inet stream,
deny network inet6 stream,
deny network netlink raw,
deny network packet,
deny network bluetooth,

Would that be the appropriate work around?

thanks