Comment 1 for bug 1483071

This is a problem with virt-aa-helper.c. Basically, in valid_path() this:

    /* override the above with these */
    const char * const override[] = {
        "/sys/devices/pci", /* for hostdev pci devices */
        "/etc/libvirt-sandbox/services/" /* for virt-sandbox service config */
    };

should be changed to:
    /* override the above with these */
    const char * const override[] = {
        "/sys/devices/pci", /* for hostdev pci devices */
        "/etc/libvirt-sandbox/services/", /* for virt-sandbox service config */
        "/usr/share/ovmf/" /* for OVMF images */
    };

See https://lists.ubuntu.com/archives/apparmor/2015-August/008466.html for details.