Comment # 2 on bug 996166 from Bat Pul

It is unclear or impossible to extend the apparmor profile of dnsmasq to use
the use the 'hostsdir' keyword in /etc/dnsmasq.conf:

# Read all the hosts files contained in the directory.
hostsdir=/usr/local/dnsmasq/hosts

/etc/apparmor.d/local/usr.sbin.dnsmasq:
# Site-specific additions and overrides for 'usr.sbin.dnsmasq'

  /usr/local/dnsmasq/hosts/ r,
  /usr/local/dnsmasq/hosts/virt r,

I still get:

$ systemctl status dnsmasq
dnsmasq[20991]: failed to create inotify for /usr/local/dnsmasq/hosts:
Permission denied