Security restriction bypass via redirected procfs writes

Security-control bypass in Apptainer before 1.4.5 allows local users to disable requested AppArmor or SELinux restrictions. The profile loaders write labels to procfs paths without ensuring that the destination is a genuine procfs file, so a malicious container can redirect the write and silently prevent the policy from taking effect. Exploitation requires a user to run the container with an AppArmor or SELinux --security option; the resulting container operates without the requested restrictions.