[nesting] Extend mount permissions in apparmor to allow systemd services' restrictions to work
These options allow systemd security features to work. In particular cases, it helps with systemd-logind and program like this
It's only added in nesting profile as it could pose security risks on privileged containers.
mount options=(rw,rbind) -> /run/systemd/unit-root/, mount options=(rw,rbind) -> /run/systemd/unit-root/**, mount options=(rw,rshared) -> /, mount options=(rw,nosuid,nodev,noexec) proc -> /run/systemd/unit-root/proc/,
update apparmor profile for userns permission and new abidiff --git a/config/apparmor/abstractions/container-base.in b/config/apparmor/abstractions/container-base.in index 87982fd..eb6b8ee 100644
