Application Sandboxing

Landlock moves path enumeration out of the AppArmor profile and into the process itself

A dev.to write-up argues that Landlock's unprivileged self-confinement retires the profile-maintenance tax that AppArmor and SELinux impose, though the rules it describes are still paths, so somebody has to enumerate them.