Comment 0 for bug 1628285

Now that we have support for apparmor namespacing and stacking, unprivileged containers can and should be allowed to load apparmor profiles.

The following changes are needed at least:
 - Change the systemd unit to remove the "!container" condition
 - Change the apparmor init script, replacing the current simple container check for something along the lines of:
    - If /proc/self/attr/current says "unconfined"
    - And /sys/kernel/security/apparmor/features/domain/stack contains "yes"
    - And /sys/kernel/security/apparmor/features/domain/version is 1.2 or higher
    - Then continue execing the script, otherwise exit 0

John suggested he could add a file which would provide a more reliable way to do this check ^

In either case, we need this change so that containers can behave more like normal systems as far as apparmor is concerned. That change should also be SRUed back to Xenial at the same time the kernel support for stacking is pushed.

This bug is effectively a blocker for snapd inside LXD as without this, snap-confine and snapd itself will not be confined after container restart.