Comment 3 for bug 1804869

I previously tested this on Ubuntu 16.04. I did again just now on 18.04 and after adding the AppArmorPermanentSlot to the profile and starting mir-kiosk, it was also able to start and create the socket at /run/user/0/wayland-0. I did see this non-fatal deny:

Feb 19 16:07:18 sec-bionic-amd64 kernel: [ 4233.682515] audit: type=1400 audit(1550614038.924:127): apparmor="DENIED" operation="open" profile="snap.mir-kiosk.mir-kiosk" name="/run/user/0/" pid=2962 comm="mkdir" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

(seems newer mkdir needs 'r'ead now).