Apparmor

Apparmor profiles for sensu components plus sensu check for apparmor entries in the logfiles.
The profile essentially allows sensu client to run ruby, whatever ruby does will be allowed.

Unfortunately I can't think of a way of limiting this further.