Comment 9 for bug 1751667

The problem is that the apparmor systemd unit (and the script it calls) exit if /rofs/etc/apparmor.d exists. This is correct in the general case. What needs to happen is either snapd loads them itself or the apparmor init scripts instead load just the snap-confine profiles.