Comment 4 for bug 1739674

Note: checked against latest libvirt plus all my incoming libvirt improvements on security domain callbacks - still affected.

The generated profile on the replace triggers:
  operation="profile_replace" info="same as current profile, skipping"

Note: workaround for now if you are affected
Add
/dev/vhost-net rw,
to
/etc/apparmor.d/abstractions/libvirt-qemu
(Sad that we have local overrides for all but the guest templates, might want to add that later)