kernel-balena: Ensure apparmor support is not enabled by default

[acostach]

Encountered apparmour being enabled onn Kernel 5.10 but it likely happens on other versions too, if they set DEFAULT_SECURITY_APPARMOR=y when APPARMOR support is enabled by the BSP. For example the security Kconfig sets:

default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR

Let's ensure DEFAULT_SECURITY_APPARMOR is disabled regardless of the BSP defconfig settings.

Change-type: patch

---

Contributor checklist

• Changes have been tested
  • Covered in automated test suite
  • Manual test case recorded
• Change-type present on at least one commit
• Signed-off-by is present
• The PR complies with the Open Embedded Commit Patch Message Guidelines

Reviewer Guidelines

• When submitting a review, please pick:
  • 'Approve' if this change would be acceptable in the codebase (even if there are minor or cosmetic tweaks that could be improved).
  • 'Request Changes' if this change would not be acceptable in our codebase (e.g. bugs, changes that will make development harder in future, security/performance issues, etc).
  • 'Comment' if you don't feel you have enough information to decide either way (e.g. if you have major questions, or you don't understand the context of the change sufficiently to fully review yourself, but want to make a comment)

[lmbarros]

Looks reasonable to me, but I'll let Alex chime in 'cause he understands the implications of these changes much better than I do.

[mtoman]

lgtm

[alexgg]

@acostach the problem with doing this is that we remove the possibility of using apparmor completely. I have opened a Zulip discussion see if we can understand why CONFIG_DEFAULT_SECURITY_APPARMOR=n is not working here.

[acostach]

ack, closing this PR in this case