Comment 1 for bug 2008825

A quick fix:
diff --git a/debian/tests/upstream-testsuite b/debian/tests/upstream-testsuite
index 161feb7..d7e1a7c 100755
--- a/debian/tests/upstream-testsuite
+++ b/debian/tests/upstream-testsuite
@@ -12,6 +12,20 @@ for ((i = 0; i < 10; i++)); do
     sleep 1
 done

+apparmor_profile="/etc/apparmor.d/usr.sbin.slapd"
+if [ -f "${apparmor_profile}" ]; then
+ if aa-status --enabled 2>/dev/null; then
+ # Adjust apparmor so slapd can read the heimdal master key
+ cat >> /etc/apparmor.d/local/usr.sbin.slapd <<EOF
+ ${AUTOPKGTEST_TMP}/** rwk,
+EOF
+ apparmor_parser -r -W -T "${apparmor_profile}" || {
+ # this failure may happen on armhf in Canonical infrastructure, see #1991141
+ echo "Failed to reload the ${apparmor_profile} apparmor profile, continuing anyway."
+ }
+ fi
+fi
+
 # see tests/HOWTO_SETUP_OPENLDAP_TESTCASE.txt and tests/ldapconfig.ini.dist
 SLAPD_ADDRESS="127.0.0.1"
 SLAPD_PORT=389

Tests still fail, though, but this time it's not because of apparmor. There are no other DENIED messages in the apparmor logs.

I note that the debian tests are also failing[1], but it migrated because the baseline for this new test is a failure, so no regression.

1. https://ci.debian.net/packages/p/php-net-ldap2/unstable/amd64/