Provide mechanism to opt-out of app armor

[sykesm]

I'm attempting to use garden-runc in an environment that does not have app armor enabled. This change allows deployments to explicitly set garden.apparmor_profile to an empty string so garden-runc does not attempt activate the app armor policy paths. By default, the app armor policy is still used.

Note: Regardless of these changes, the job spec allows users to change the policy name but the start script hard-coded garden-default. It's also strange that the policy is a release template but there's no way to customize it. A nice feature would be to provide a mechanism for deployments to include a custom policy definition.

[cfdreddbot]

Hey sykesm!

Thanks for submitting this pull request! I'm here to inform the recipients of the pull request that you and the commit authors have already signed the CLA.

[garden-gnome]

Hi there!

We use Pivotal Tracker to provide visibility into what our team is working on. A story for this issue has been automatically created.

The current status is as follows:

• #137384493 Provide mechanism to opt-out of app armor

This comment, as well as the labels on the issue, will be automatically updated as the status in Tracker changes.

[craigfurman]

Thanks @sykesm

[loewenstein]

From what I have seen the original problems remains, i.e. minikube does not have app armor enabled. There is no /sys/kernel/security, so

mount -t securityfs securityfs /sys/kernel/security

in https://github.com/cloudfoundry/garden-runc-release/blob/v1.5.0/jobs/garden/templates/garden_ctl.erb#L70 fails with

mount: mount point /sys/kernel/security does not exist

The same is true for

apparmor_parser -a $CONFIG_DIR/$default_policy

in https://github.com/cloudfoundry/garden-runc-release/blob/v1.5.0/jobs/garden/templates/garden_ctl.erb#L74.
It fails with

apparmor module is not loaded.
Cache read/write disabled: interface file missing. (Kernel needs AppArmor 2.4 compatibility patch.)
Warning: unable to find a suitable fs in /proc/mounts, is it mounted?
Use --subdomainfs to override.