[apparmor] [Patch 0/18] aafs profile introspection interface & misc patches v2

[John Johansen]

Most of these patches are the same as last time but need to be applied
as a series to get the profile introspection interface working.

The profile introspection interface has been reworked based on previous
discussions.  The layout looks like

/sys/kernel/security/apparmor/
  .load
  .remove
  .replace
  features/
  profiles
  policy/				# new policy dir
      profiles				# profiles in the namespace
        9-usr.bin.foo/			# sid-mangled profile name
          name				# profile name
	  mode				# profile mode (enforce, complain)
          attach			# attachment re string
          profiles/			# hats and children profiles
            12-bar/
	       name
	       mode
      namespaces/			# namespaces under root
        ns1/				# example sub ns
          profiles/
          namespaces/


the root namespace directory has now been collapsed under policy/ so
policy starts with the currently visible namespace(1).

profile directory names are unique. They begin with the sid (in decimal
instead of hex) followed by a mangled profile name for human readability.
The mangling can change in the future so scripts should not rely upon it.

The profile directory currently does not export the sid since nothing
using it, and a new attach file that provides the attachment expression
if it is different than the profile name(2)

File contents are now newline terminated to aid view from shell commands

The profiles sub directory of a profile (eg 9-usr.bin.foo) is dynamic
and only created if the profile has children or hats

The profiles sub directory under namespaces is not dynamic is always
created when a namespace is created.

The code has been cleaned up a lot and has fixed several problems of the
v1 code. One major fix was a refactoring to the profile loading that
allows for multiple profiles to load atomically. This wasn't strictly
necessary for the interface but this portion of the code had to be
reworked to fix the problem of profiles load succeeding but failing
to create the interface (this is now fixed).

There is currently one major issue to be resolved around locking. A minor
issue with making the profile_mkdir and namespace_mkdir code table driven
also exists but is low priority and problematic due to its dynamic nature.

Hopefully this is a sufficient base to start moving forward and get
updating userspace etc, and hopefully by v3 it will be ready to start
pushing upstream.


1 This is the intended behavior the current patch does not virtualize
  the policy directory, and that will have to come later but can
  be achieved via bind mounts

2 This requires a patched parser as well