apparmor: add the ability for policy to specify a permission table