Merge pull request #1082 from edx/dcs/aaenforce

Added pyexpat to whitelisted shared objects, and flipped apparmor mode to enforce.

playbooks/roles/edxapp/templates/code.sandbox.j2

 #include <tunables/global>
 
-{{ edxapp_sandbox_venv_dir }}/bin/python flags=(complain) {
+{{ edxapp_sandbox_venv_dir }}/bin/python {
     #include <abstractions/base>
 
     {{ edxapp_sandbox_venv_dir }}/** mr,
@@ -19,10 +19,14 @@
     /usr/lib/python2.7/lib-dynload/_csv.so mr,
     /usr/lib/python2.7/lib-dynload/datetime.so mr,
     /usr/lib/python2.7/lib-dynload/_elementtree.so mr,
+    /usr/lib/python2.7/lib-dynload/pyexpat.so mr,
 
     #
     # Allow access to selections from /proc
     #
     /proc/*/mounts r,
     
+    /tmp/codejail-*/ rix,
+    /tmp/codejail-*/** wrix,
+
 }