Using bin_path in the apparmor template

playbooks/roles/xqwatcher/tasks/main.yml

@@ -44,6 +44,8 @@
 # meta data and details related to the repository including the
 # grader code.
 #
+# NOTA BENE: Apparmor does not follow symlinks
+#
 # XQWATCHER_COURSES:
 #   - COURSE: "exampleX-101x"
 #     GIT_REPO: "git@github.com:foo/graders-exampleX-101x.git"
@@ -59,7 +61,7 @@
 #         - HANDLER: "xqueue_watcher.jailedgrader.JailedGrader"
 #           CODEJAIL:
 #             name: "exampleX-101x"
-#             bin_path: "{{ xqwatcher_venv_base }}/exampleX-101x/bin/python"
+#             bin_path: "{{ xqwatcher_venv_base }}/exampleX-101x/bin/python2"
 #             user: "exampleX-101x"
 #             lang: python2
 #           KWARGS:
@@ -78,9 +80,9 @@
 #         - HANDLER: "xqueue_watcher.jailedgrader.JailedGrader"
 #           CODEJAIL:
 #             name: "exampleX-202x"
-#             bin_path: "{{ xqwatcher_venv_base }}/exampleX-202x/bin/python"
+#             bin_path: "{{ xqwatcher_venv_base }}/exampleX-202x/bin/python3"
 #             user: "exampleX-202x"
-#             lang: python2
+#             lang: python3
 #           KWARGS:
 #             grader_root: "../data/exampleX-202x/graders/"
 

playbooks/roles/xqwatcher/templates/etc/apparmor.d/code.jail.j2

 #include <tunables/global>
 
-{{ xqwatcher_app_dir }}/venvs/{{ item.QUEUE_CONFIG.HANDLERS[0].CODEJAIL.name }}/bin/python {
+{{ item.QUEUE_CONFIG.HANDLERS[0].CODEJAIL.bin_path }} {
     #include <abstractions/base>
 
     {{ xqwatcher_app_dir }}/venvs/{{ item.QUEUE_CONFIG.HANDLERS[0].CODEJAIL.name }}/** mr,