apparmor-session-lockdown: assert that subprocesses succeed

We were running commands like "pactl stat" and then ignoring their
nonzero exit status.

I've included support for ignoring failures, but in fact we never
actually run anything in this test that can legitimately fail, so
it's unused.

Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3447

apparmor/session-lockdown/no-deny

@@ -111,7 +111,7 @@ def find_apparmorfs():
             return os.path.join(p.split()[1].decode(), "apparmor")
     return False
 
-def log_subprocess(*argv):
+def log_subprocess(*argv, may_fail=False):
     with subprocess.Popen(argv, stdin=subprocess.DEVNULL,
             stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
             universal_newlines=True) as proc:
@@ -124,6 +124,11 @@ def log_subprocess(*argv):
 
         print('#\\--')
         print('# -> exit status {}'.format(proc.wait()))
+
+        if proc.returncode != 0 and not may_fail:
+            raise AssertionError('{!r} returned {}'.format(argv,
+                proc.returncode))
+
         return proc.returncode
 
 def before_reboot():