RFC: drop dependency on libapparmor and reimplement aa_change_exec in Go

[tklauser]

libapparmor is integrated in libcontainer using cgo but is only used to call a single function: aa_change_onexec in https://github.com/opencontainers/runc/blob/master/libcontainer/apparmor/apparmor.go#L35.

The dependency on libapparmor requires additional packages to be installed for runc/libcontainer to be built and run, which might cause confusion for some users (e.g see #1486).

Looking at aa_change_onexec in libapparmor it seems like is simple enough (writing a string to a file in /proc//attr/...) to be re-implemented locally in libcontainer in plain Go.

I have an untested PR ready locally which I can submit if people think this is a worthwhile thing to do. In the meantime I'll try to figure out how to test this properly (i.e. getting runc to run with an apparmor profile).

[tklauser]

FWIW, here's the implementation from libapparmor (libraries/libapparmor/src/kernel.c):

static int setprocattr(pid_t tid, const char *attr, const char *buf, int len)
{
        int rc = -1;
        int fd, ret;
        char *ctl = NULL;

        if (!buf) {
                errno = EINVAL;
                goto out;
        }

        ctl = procattr_path(tid, attr);
        if (!ctl)
                goto out;

        fd = open(ctl, O_WRONLY);
        if (fd == -1) {
                goto out;
        }

        ret = write(fd, buf, len);
        if (ret != len) {
                int saved;
                if (ret != -1) {
                        errno = EPROTO;
                }
                saved = errno;
                (void)close(fd);
                errno = saved;
                goto out;
        }

        rc = 0;
        (void)close(fd);

out:
        if (ctl) {
                free(ctl);
        }
        return rc;
}

int aa_change_onexec(const char *profile)
{                                                                                                                                                                                    
        char *buf = NULL;                                                                                                                                                            
        int len;
        int rc;
                                                                                                                                                                                     
        if (!profile) {                                                                                                                                                              
                errno = EINVAL;                                                                                                                                                      
                return -1;                                                                                                                                                           
        }                                                                                                                                                                            
                                                                                                                                                                                     
        len = asprintf(&buf, "exec %s", profile);                                                                                                                                    
        if (len < 0)                                                                                                                                                                 
                return -1;                                                                                                                                                           
                                                                                                                                                                                     
        rc = setprocattr(aa_gettid(), "exec", buf, len);                                                                                                                             
        
        free(buf);
        return rc;                                                                                                                                                                   
}