[doc] Add AppArmor profile setup for rootlesskit on Ubuntu 24.04+

[fahedouch]

This PR fix #2847:

• Add documentation for AppArmor profile setup for rootlesskit on Ubuntu 24.04+

[AkihiroSuda]

I don't think that the rootless set up tool should invoke sudo.

rootlesskit already prints the hint when the AppArmor condition is not satisfied.
https://github.com/rootless-containers/rootlesskit/blob/v2.3.1/pkg/parent/warn.go#L84

[fahedouch]

ah my bad! I didn't know it was supported by rootlesskit, I will reflect this in the documentation

[fahedouch]

Apparmor warn message already handled by the ./containerd-rootless-setuptool.sh check

faheddorgaa@lima-default:/Users/faheddorgaa/go/src/github.com/nerdctl/extras/rootless$ ./containerd-rootless-setuptool.sh check
[INFO] Checking RootlessKit AppArmor profile
[INFO] Checking RootlessKit functionality
WARN[0000] [rootlesskit:parent] This error might have happened because /proc/sys/kernel/apparmor_restrict_unprivileged_userns is set to 1  error="fork/exec /proc/self/exe: permission denied"
WARN[0000] [rootlesskit:parent] Hint: try running the following commands:


########## BEGIN ##########
cat <<EOT | sudo tee "/etc/apparmor.d/usr.local.bin.rootlesskit"
# ref: https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces
abi <abi/4.0>,
include <tunables/global>

/usr/local/bin/rootlesskit flags=(unconfined) {
  userns,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/usr.local.bin.rootlesskit>
}
EOT
sudo systemctl restart apparmor.service
########## END ##########
 
[rootlesskit:parent] error: failed to start the child: fork/exec /proc/self/exe: permission denied
[ERROR] RootlessKit failed, see the error messages and https://rootlesscontaine.rs/getting-started/common/ .

documentation updated.

[AkihiroSuda]

remove

[AkihiroSuda]

This is not true when rootlesskit is installed via apt-get

[AkihiroSuda]

You may link https://rootlesscontaine.rs/getting-started/common/apparmor/

[AkihiroSuda]

Thanks