apparmor: fix unprivileged local user can do privileged policy management

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix unprivileged local user can do privileged policy management

An unprivileged local user can load, replace, and remove profiles by

opening the apparmorfs interfaces, via a confused deputy attack, by

passing the opened fd to a privileged process, and getting the

privileged process to write to the interface.

This does require a privileged target that can be manipulated to do

the write for the unprivileged process, but once such access is

achieved full policy management is possible and all the possible

implications that implies: removing confinement, DoS of system or

target applications by denying all execution, by-passing the

unprivileged user namespace restriction, to exploiting kernel bugs for

a local privilege escalation.

The policy management interface can not have its permissions simply

changed from 0666 to 0600 because non-root processes need to be able

to load policy to different policy namespaces.

Instead ensure the task writing the interface has privileges that

are a subset of the task that opened the interface. This is already

done via policy for confined processes, but unconfined can delegate

access to the opened fd, by-passing the usual policy check.