Add the ability to separate policy_version from kernel and parser abi

This will allow for the parser to invalidate its caches separate of whether
the kernel policy version has changed. This can be desirable if a parser
bug is discovered, a new version the parser is shipped and we need to
force cache files to be regenerated.

Policy current stores a 32 bit version number in the header binary policy.
For newer policy (> v5 kernel abi) split this number into 3 separate
fields policy_version, parser_abi, kernel_abi.

If binary policy with a split version number is loaded to an older
kernel it will be correctly rejected as unsupported as those kernels
will see it as a none v5 version. For kernels that only support v5
policy on the kernel abi version is written.

The rules for policy versioning should be
policy_version:
  Set by text policy language version. Parsers that don't understand
  a specified version may fail, or drop rules they are unaware of.

parser_abi_version:
  gets bumped when a userspace bug is discovered that requires policy be
  recompiled. The policy version could be reset for each new kernel version
  but since the parser needs to support multiple kernel versions tracking
  this is extra work and should be avoided.

kernel_abi_version:
  gets bumped when semantic changes need to be applied. Eg unix domain
  sockets being mediated at connect.

  the kernel abi version does not encapsulate all supported features.
  As kernels could have different sets of patches supplied. Basic feature
  support is determined by the policy_mediates() encoding in the policydb.

  As such comparing cache features to kernel features is still needed
  to determine if cached policy is best matched to the kernel.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>

parser/parser_regex.c

@@ -692,7 +692,7 @@ int process_profile_policydb(Profile *prof)
 	 */
 
 	/* note: this activates unix domain sockets mediation on connect */
-	if (kernel_policy_version > 5 &&
+	if (kernel_abi_version > 5 &&
 	    !prof->policy.rules->add_rule(mediates_file, 0, AA_MAY_READ, 0, dfaflags))
 		goto out;
 	if (kernel_supports_mount &&