Comment # 1 on bug 924830 from Christian Boltz

This is a regression in the newest systemd.

# systemctl show apparmor.service | grep "Default"
DefaultDependencies=yes

With systemd-210, it was (as it should be for a boot.* initscript)
DefaultDependencies=no