Add a SELinux CIL module that denies AF_ALG socket creation for all
container domains.

Like AppArmor, SELinux hooks into the kernel's security_socket_create()
LSM callback, blocking AF_ALG regardless of whether the socket was
created via socket(2) or socketcall(2), without disrupting other
socketcall usage by 32-bit binaries.

This is shipped as a standalone CIL file for packaging repos to install
via semodule. It is not loaded by moby itself.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

Seccomp cannot filter socketcall(2) arguments because the address
family is behind a userspace pointer that BPF cannot dereference.
Only an LSM (AppArmor or SELinux) can deny AF_ALG via the
security_socket_create hook in the socketcall path.

Skip the socketcall_int80 subtest when neither AppArmor nor SELinux
is reported by the daemon, since the test would always fail without
an LSM to enforce the deny rule.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

Add "deny network alg," to the default AppArmor profile.

Unlike seccomp, which can only filter arguments of the direct socket(2)
syscall, AppArmor hooks into the kernel's security_socket_create() LSM
callback, which fires regardless of the syscall entry point. This means
AppArmor also blocks AF_ALG sockets created via the legacy socketcall(2)
multiplexer (used by 32-bit binaries), which seccomp cannot inspect
because the address family is behind a userspace pointer that BPF cannot
dereference.

Crucially, AppArmor can deny AF_ALG selectively without blocking
socketcall entirely.

A blanket seccomp socketcall deny broke all 32-bit networking since
glibc on i386 routes every socket operation through socketcall.

AppArmor operates at the socket layer, not the syscall layer, so it
blocks only the specific address family while leaving all other
socketcall usage intact.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

With the apparmor based block, it will now fail with EPERM

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

We now rely on the LSM-based solution for the hardening.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>