session-lockdown: provide better diagnostics

Reviewed-by: Mathieu Duponchelle <mathieu.duponchelle@opencreed.com>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D3638

apparmor/session-lockdown/no-deny

@@ -97,7 +97,10 @@ def get_processes(profiles):
                         # keep only unconfined processes that have a profile defined
                         processes[filename] = { 'profile' : exe,
                                                 'mode' : 'unconfined' }
-                    elif p.strip() != 'unconfined':
+                    elif p.strip() == 'unconfined':
+                        # this is fine: something like process 1 (systemd)
+                        print('# unconfined process {!r} {!r} has no profile, ignoring'.format(filename, exe))
+                    else:
                         not_ok('process {} {!r} context {!r} could not be '
                                'parsed'.format(filename, exe, p))
             except: