Comment 6 for bug 1377239

Okay, step by step:

cups-pdf policy has: #include <abstractions/nameservice> yes

/etc/apparmor.d/abstractions/nameservice has: #include <abstractions/winbind> yes

/etc/apparmor.d/abstractions/winbind has: /var/{lib,run}/samba/winbindd_privileged/pipe rw, yes

I am using ubuntu defaults. All apparmor files are unchanged, but it only works when I add following to cups-pdf policy:
           /run/samba/winbindd/pipe rw,

Eventually it's because /var/run/samba/winbindd_privileged/pipe is not available, but /var/lib/samba/winbindd_privileged/pipe is.

The permissions on both pipes are the same:
0 srwxrwxrwx 1 root root 0 Okt 3 15:13 /var/lib/samba/winbindd_privileged/pipe
0 srwxrwxrwx 1 root root 0 Okt 3 15:13 /run/samba/winbindd/pipe