Comment 5 for bug 2063079

Given that:
- samba's apparmor profile is not enabled by default. One has to install apparmor-profiles, and put the profile in enforce mode (it's in complain mode by default)
- we are in the release week, isos are being built. This could at most be a 0-day SRU
- we have been running without this fix since at least January, and enabling it now could be risky (every smbd start will invoke a shell script which could make the service fail

I think a normal SRU for noble is best. I could even add a set of DEP8 tests for this, to see how samba works with the profile from apparmor-profiles.

The only downside I see is that not applying the fix now would mean a release-upgrade regression for the users who are using an apparmored samba. We can release note it for now.

What do you think?