Use apparmor-support module

[zyga]

This branch builds upon #188 to switch all of snap-confine over to the wrapped apparmor APIs.

The main commit describes why this is beneficial:

This patch changes snap-confine to call apparmor functions indirectly,
through apparmor-support APIs. Those APIs are always available, even if
apparmor is not enabled at compile time. This cuts the number of ifdefs
that have to be scattered around the code a little.

As an indirect improvement the sc_maybe_aa_change_hat() function relies
on an earlier call to sc_apparmor_init() which calls aa_getcon() to
determine if the snap-confine process is itself confined. If it is not,
the hat change is not attempted as it would always fail.

Signed-off-by: Zygmunt Krynicki zygmunt.krynicki@canonical.com

[tyhicks]

Looks good.

[tyhicks]

You can drop the "probably" here. It is used to find where securityfs is mounted.

[zyga]

Thanks, I will