libapparmor: Move python stuff to a separate output

This prevents systemd and by extension a zillion other packages from
having Python 2.7 in their closure. For example, the closure of
systemd dropped from 133 MiB to 85 MiB.

pkgs/os-specific/linux/apparmor/default.nix

@@ -32,6 +32,8 @@ let
     substituteInPlace ./common/Make.rules --replace "/usr/share/man" "share/man"
   '';
 
+  # FIXME: convert these to a single multiple-outputs package?
+
   libapparmor = stdenv.mkDerivation {
     name = "libapparmor-${apparmor-version}";
     src = apparmor-sources;
@@ -61,6 +63,13 @@ let
     postPatch = "cd ./libraries/libapparmor";
     configureFlags = "--with-python --with-perl";
 
+    outputs = [ "out" "python" ];
+
+    postInstall = ''
+      mkdir -p $python/lib
+      mv $out/lib/python* $python/lib/
+    '';
+
     meta = apparmor-meta "library";
   };
 
@@ -75,6 +84,7 @@ let
       pythonPackages.python
       pythonPackages.readline
       libapparmor
+      libapparmor.python
     ];
 
     prePatch = prePatchCommon;