Runtime should support apparmor

[xibz]

• should enforce a profile blocking writes
• should fail with with an unloaded profile
• should enforce a permissive profile