This could enable apparmor again on hosts where it has been explicitly disabled.

Can you change this behavior so that it only includes if 'apparmor_enabled' is true, and then handle by setting the value in attributes/default.rb to default true for debian-family platforms? This gives users a way to disable in all cases.