Add installation/enable_apparmor module and run it if SELINUX=0

On distros which default to SELinux during installation, provide a way to
switch to AppArmor.

lib/main_common.pm

@@ -1107,7 +1107,8 @@ sub load_inst_tests {
             loadtest "installation/disable_grub_graphics";
         }
         # Do not run enable_selinux in systems that have SELinux by default (bsc#1230118)
-        loadtest "installation/enable_selinux" if get_var('SELINUX') && !has_selinux_by_default;
+        loadtest "installation/enable_selinux" if check_var('SELINUX', '1') && !has_selinux_by_default;
+        loadtest "installation/enable_apparmor" if check_var('SELINUX', '0') && has_selinux_by_default;
 
         if (check_var("UPGRADE", "LOW_SPACE")) {
             loadtest "installation/disk_space_release";

tests/installation/enable_apparmor.pm

@@ -0,0 +1,31 @@
+# SUSE's openQA tests
+#
+# Copyright 2025 SUSE LLC
+# SPDX-License-Identifier: FSFAP
+
+# Summary: Enable AppArmor during installation
+# Maintainer: Fabian Vogt <fvogt@suse.de>
+
+use strict;
+use warnings;
+use base 'y2_installbase';
+use testapi;
+
+sub run {
+    my ($self) = @_;
+    my $textmode = check_var('VIDEOMODE', 'text');
+
+    $self->go_to_security_settings();
+
+    send_key 'alt-s';
+    send_key_until_needlematch 'security-module-apparmor', 'down';
+    send_key 'ret' if $textmode;
+
+    send_key $cmd{ok};
+
+    # Make sure the overview is fully loaded and not being recalculated
+    wait_still_screen(3);
+    assert_screen 'installation-settings-overview-loaded';
+}
+
+1;