Comment 1 for bug 2067900

This requires a v4.0 apparmor parser and Ubuntu not upstream kernel.

The ubuntu kernel carries a patch that is work toward splitting unconfined and making so it can replaced and only cause mediation overhead for the classes being mediated.

The 4.0 parser is setting mediated classes in unconfined profiles when it shouldn't, causing pivot root to fail.