tools: Add AppArmor profile for cockpit-desktop

[martinpitt]

Ubuntu 24.04 LTS restricts user name spaces by default. Add an AppArmor profile for cockpit-desktop to allow it. This is a no-op for older releases.

See https://launchpad.net/bugs/2046477 for details.

---

Blocks cockpit-project/bots#6048

[allisonkarlitskaya]

I'm OK with this, but I wonder if we should have rather placed that file 'downstream' (ie: inside of the packaging, and not part of make install)

[martinpitt]

@allisonkarlitskaya that's what I did. EXTRA_DIST != "make install", it just needs to end up in the tarball.

[martinpitt]

Ah, I think you meant put the whole policy into tools/debian/ ... Hm, maybe, but other distros like openSUSE have AppArmor as well. I thought tools/ would be harmless enough for that.

Anyway, I'll land it, so that we can unbreak it in tomorrow's release.

[jradxl]

In case this is of significance, I report it...
I have used your make-deb script on Ubuntu 22.04 to build latest version 314.
Once installed a new file /etc/apparmor.d/cockpit-desktop is added.
On the next reboot, the apparmor service does not start

aa-complain /usr/lib/cockpit/cockpit-desktop
ERROR: Syntax Error: Unknown line found in file /etc/apparmor.d/cockpit-desktop line 6:
userns,

Work around is to remove this file and restart apparmor