We discussed this on IRC and after some debugging it looks like apparmor userspace systemd unit is not loading profiles from /var/lib/snapd/apparmor/profiles.
We have some features that may fix this in general and I was wondering if we should deploy the new snapd.apparmor.service across the stack (everywhere where appamor is enabled).
@zyga-snapd seem related to layout, when I remove layouts from snap.yaml it works as expected.
At the same time I have added before same layout to the same snap and it was working fine, only when I did clean rebuild of the snap, it went south…
openSUSE Tumbleweed users seem to find this thread. For them it’s useful to note that when they install or update snapd nowadays, they get the following guidance which when executed fixes the error message from this thread:
“On a Tumbleweed system you need to run: systemctl enable snapd.apparmor.service”
(also, remember to systemctl enable snapd.service too)