I found that the program "evince" which is used for PDF reading/viewing writes to the home drive
See /etc/apparmor.d/usr.bin.evince where it has:
# evince creates a temporary stream file like '.goutputstream-XXXXXX' in the
# directory a file is saved. This allows that behavior.
owner /**/.goutputstream-* w,
Of course, several other programs could use the same technique to save status info, neglects to clean them up.
I found that the program "evince" which is used for PDF reading/viewing writes to the home drive d/usr.bin. evince where it has:
See /etc/apparmor.
# evince creates a temporary stream file like '.goutputstream -XXXXXX' in the eam-* w,
# directory a file is saved. This allows that behavior.
owner /**/.goutputstr
Of course, several other programs could use the same technique to save status info, neglects to clean them up.