apparmor: sysctl to enable unprivileged user ns AppArmor policy loading

If this sysctl is set to non-zero and a process with CAP_MAC_ADMIN in
the root namespace has created an AppArmor policy namespace,
unprivileged processes will be able to change to a profile in the
newly created AppArmor policy namespace and, if the profile allows
CAP_MAC_ADMIN and appropriate file permissions, will be able to load
policy in the respective policy namespace.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>

security/apparmor/policy.c

@@ -99,7 +99,6 @@ const char *const aa_profile_mode_names[] = {
 	"unconfined",
 };
 
-
 /* requires profile list write lock held */
 void __aa_update_proxy(struct aa_profile *orig, struct aa_profile *new)
 {