include of dir fails when the number of files in the dir approaches or exceeds the processes fd limit

[John Johansen]

The apparmor parser handles directory includes in an odd way, where each file in the directory is opened and the pushed as a flex buffer state before any files in the directory are actually processed. The flex buffers and associated fds are then processed one by one and the <eof> handling pops the buffer (and closes the fd) to get to the next file to process.

This means that if a directory contains a lot of files the include could fail as the parser will run out of available fds.

[John Johansen (jjohansen)]

This can be worked around by splitting large directory includes into multiple directories, or increasing the processes open fd limit.