refactor AppArmor into LSM backend, add SELinux support

Currently, a maximum of one LSM within LXC will be initialized and
used. If in the future stacked LSMs become a reality, we can support it
without changing the configuration syntax and add support for more than
a single LSM at a time to the lsm code.

Generic LXC code should note that lsm_process_label_set() will take
effect "now" for AppArmor, and upon exec() for SELinux.

- fix Oracle template mounting of proc and sysfs, needed when using SELinux

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
fix segfault on lxc-create with bad template name

- change get_template_path() to only return NULL or non-NULL since one of
  the callers was doing a free(-1) which caused the segfault. Handle the
  NULL template case in the lxcapi_create() caller.

- make sure to free(tpath) in the sha1sum_file() failure case

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
drop now-useless have_tpath bool

(Which will also break failure-to-build in the !HAVE_LIBGNUTLS
case)

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>