After more debugging, I found more paths being blocked by apparmor:
apparmor="DENIED" operation="open" profile="/usr/bin/nova-compute" name="/dev/mapper/control" pid=24599 comm="multipath" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0 apparmor="DENIED" operation="open" profile="/usr/bin/nova-compute" name="/proc/sys/fs/nr_open" pid=25595 comm="multipath" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 apparmor="DENIED" operation="open" profile="/usr/bin/nova-compute" name="/proc/devices" pid=26965 comm="multipath" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 apparmor="DENIED" operation="open" profile="/usr/bin/nova-compute" name="/etc/multipath/bindings" pid=27233 comm="multipath" requested_mask="wrc" denied_mask="wrc" fsuid=0 ouid=0 apparmor="DENIED" operation="open" profile="/usr/bin/nova-compute" name="/etc/multipath/wwids" pid=27233 comm="multipath" requested_mask="wrc" denied_mask="wrc" fsuid=0 ouid=0 apparmor="DENIED" operation="open" profile="/usr/bin/nova-compute" name="/etc/udev/udev.conf" pid=29130 comm="multipathd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 apparmor="DENIED" operation="unlink" profile="/usr/bin/nova-compute" name="/dev/disk/by-id/scsi-1IET_00030001" pid=28989 comm="privsep-helper" requested_mask="d" denied_mask="d" fsuid=0 ouid=0
After more debugging, I found more paths being blocked by apparmor:
apparmor="DENIED" operation="open" profile= "/usr/bin/ nova-compute" name="/ dev/mapper/ control" pid=24599 comm="multipath" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0 "/usr/bin/ nova-compute" name="/ proc/sys/ fs/nr_open" pid=25595 comm="multipath" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 "/usr/bin/ nova-compute" name="/ proc/devices" pid=26965 comm="multipath" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 "/usr/bin/ nova-compute" name="/ etc/multipath/ bindings" pid=27233 comm="multipath" requested_ mask="wrc" denied_mask="wrc" fsuid=0 ouid=0 "/usr/bin/ nova-compute" name="/ etc/multipath/ wwids" pid=27233 comm="multipath" requested_ mask="wrc" denied_mask="wrc" fsuid=0 ouid=0 "/usr/bin/ nova-compute" name="/ etc/udev/ udev.conf" pid=29130 comm="multipathd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 "/usr/bin/ nova-compute" name="/ dev/disk/ by-id/scsi- 1IET_00030001" pid=28989 comm="privsep- helper" requested_mask="d" denied_mask="d" fsuid=0 ouid=0
apparmor="DENIED" operation="open" profile=
apparmor="DENIED" operation="open" profile=
apparmor="DENIED" operation="open" profile=
apparmor="DENIED" operation="open" profile=
apparmor="DENIED" operation="open" profile=
apparmor="DENIED" operation="unlink" profile=