cmd/snap-confine: don't use apparmor if it is disabled on boot

[zyga]

If apparmor is not enabled (either in the kernel or on boot) then don't
try to use it, even if it is compiled into snap-confine.

Signed-off-by: Zygmunt Krynicki zygmunt.krynicki@canonical.com

[jdstrand]

These changes are fine and should have been in place when SC_AA_NOT_APPLICABLE was first implemented. Ie, it is an obvious (in retrospect) bug that snap-confine is trying to change_onexec and change_hat when there is nothing it can change to.

Note, all the discussion on whether or not SC_AA_NOT_APPLICABLE should be a thing already happened in its PR and the decision was made that it is more important to fail open when apparmor is unavailable than to fail closed. This PR just goes along with the previous decision.

[jdstrand]

That said, it would be nice to see a test here to tack onto any tests for SC_AA_NOT_APPLICABLE. I won't block on that though.

[mvo5]

Looks good to me, but 👍 for a test (but I agree we should not block on it)