PAM auth no longer works after upgrade to 16.04.1

[Nathan Rennie-Waldock]

Since upgrading from 15.10 to 16.04.1, PAM authentication no longer works.

(basic_pam_auth)[21687]: PAM _pam_init_handlers: no default config /etc/pam.d/other
(basic_pam_auth)[21687]: PAM error reading PAM configuration file
(basic_pam_auth)[21687]: PAM pam_start: failed to initialize handlers

There's 2 issues with this:
1. /etc/pam.d/other does exist
2. But the service name is squid and /etc/pam.d/squid exists, containing:
auth required pam_unix.so
account required pam_unix.so

Squid config:
$ grep ^auth_param /etc/squid/squid.conf
auth_param basic program /usr/lib/squid/basic_pam_auth
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours

Running basic_pam_auth myself works correctly:
$ sudo -u proxy /usr/lib/squid/basic_pam_auth
user password
OK

$ apt-cache policy squid
squid:
  Installed: 3.5.12-1ubuntu7.2
  Candidate: 3.5.12-1ubuntu7.2
  Version table:
 *** 3.5.12-1ubuntu7.2 500
        500 http://de.archive.ubuntu.com/ubuntu xenial-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu xenial-security/main amd64 Packages
        100 /var/lib/dpkg/status
     3.5.12-1ubuntu7 500
        500 http://de.archive.ubuntu.com/ubuntu xenial/main amd64 Packages

[Nathan Rennie-Waldock (nathan-renniewaldock)]

Just figured out it was being eaten by AppArmor.
For anyone else, you need to add:
#include <abstractions/authentication>
to /etc/apparmor.d/local/usr.sbin.squid
and reload apparmor