To make sure we get this right, can you please check /var/log/audit/audit.log for AppArmor denials (or simply attach that file)?