Code review comment for lp:~michihenning/unity-scopes-api/scope-cache-dir

> > I preferred leaf-net, leaf-fs and aggregator so that you don't have to
> change
> > your code if we ever do implement leaf-fs or aggregator policy in the future
> > (note, just because we may never make these available to third party
> > developers, it doesn't mean we won't want apparmor policy for our own
> stuff).
>
> Would the policy for an aggregator every be different from an unconfined
> scope?
> I guess the question is whether I should use "leaf-fs", "leaf-net",
> "aggregator", and "unconfined"?
>
> It's really neither here nor there to me--the list can be as long as we like
> and, if some of the directories in there don't exist, the right things still
> happen.
>
> For the time being, I'll just check for both "aggregator" and "unconfined".
> That way, we have our bases covered. Michal, Jamie, please speak up if you
> think this is wrong or if I'm missing something!

I think it is conceivable that an aggregator can be confined, especially when considering that we might want to confine it for code execution, etc even if the aggregator is still only for trusted 3rd parties. I don't think the scopes team should worry about what confinement goes with what-- just worry about keeping the types (leaf-net, leaf-fs, aggregator, whatever) separate and don't let them share writable when changing between them with the understanding that confinement will enforce this separation.