Fix AppArmor 3.0 support (closes #3659)

[kris7t]

AppArmor introduces the @{run} variable, which is used in
<abstractions/dbus-strict> and <abstractions/dbus-session-strict> among
other places. Thus, we must #include <tunables/run> to be able to call
these abstractions.

Standard profiles rely on <tunables/global> to include <tunables/run>, since it exists in previous AppArmor versions, too.

As an attempt at backwards compatibility, we #include if exists instead
of #include, since there is no <tunables/run> in AppArmor 2.x.

However, if exists is a relatively new feature, see e.g.
https://phabricator.kde.org/D14526
(However, do note that if exists does not appear as a new feature in
https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13).
Therefore, this commit restricts our compatibility to relatively new
(<10 months) old AppArmor releases only.

As an alternative, we could detect the AppArmor version at configure
time, and emit a firejail-default profile based on that.

Here, I opted for the simpler approach, as distributions likely to ship >10 months old AppArmor (Debian) support Firejail on their own via backports (according to https://github.com/netblue30/firejail/security/policy), anyways.

[reinerh]

AppArmor introduces the @{run} variable, which is used in
<abstractions/dbus-strict> and <abstractions/dbus-session-strict> among
other places. Thus, we must #include <tunables/run> to be able to call
these abstractions.

If the abstractions are using the @{run} variable, isn't that a bug in these abstractions and would be better addressed there?
When they start using the tunable or drop the variable completely in the future, we have an unnecessary import in our profile.

As an attempt at backwards compatibility, we #include if exists instead
of #include, since there is no <tunables/run> in AppArmor 2.x.

However, if exists is a relatively new feature, see e.g.
https://phabricator.kde.org/D14526
(However, do note that if exists does not appear as a new feature in
https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13).
Therefore, this commit restricts our compatibility to relatively new
(<10 months) old AppArmor releases only.

Ubuntu 18.04 LTS still ships with 2.12. Though I could patch it when uploading to the PPA.

[kris7t]

@reinerh The two examples of <abstraction/dbus> use I could find in the built-in profiles were usr.sbin.avahi-daemon and usr.sbin.dnsmasq. Both of these include <tunables/global> before including <abstractions/dbus>, which in turn includes <tunables/run>.

So most likely <abstractions/dbus-strict> is not broken, we just have to follow convention by including <tunables/global>. Luckily, <tunables/global> is pretty old, so we don't need if exists when including it. This should clear up the backwards compatibility issue. I'll update my patch accordingly.