diff -Nru squid3-3.3.8/debian/changelog squid3-3.3.8/debian/changelog
--- squid3-3.3.8/debian/changelog	2014-11-24 20:43:37.000000000 +0300
+++ squid3-3.3.8/debian/changelog	2015-03-03 19:30:51.000000000 +0300
@@ -1,3 +1,11 @@
+squid3 (3.3.8-1ubuntu10) vivid; urgency=medium
+
+  [Jacek Nykis]
+  * d/usr.sbin.squid3: Apparmor profile has been changed to allow child
+    processes to run execvp(argv[0], [kidname, ...]). (LP: #1416039)
+
+ -- Oleg Strikov <oleg.strikov@canonical.com>  Tue, 03 Mar 2015 18:18:20 +0300
+
 squid3 (3.3.8-1ubuntu9) vivid; urgency=medium
 
   * Fix various ICMP handling issues in Squid pinger. (LP: #1384943)
diff -Nru squid3-3.3.8/debian/usr.sbin.squid3 squid3-3.3.8/debian/usr.sbin.squid3
--- squid3-3.3.8/debian/usr.sbin.squid3	2014-11-24 20:40:59.000000000 +0300
+++ squid3-3.3.8/debian/usr.sbin.squid3	2015-03-03 19:31:51.000000000 +0300
@@ -13,6 +13,9 @@
   capability setgid,
   capability sys_chroot,
 
+  # allow child processes to run execvp(argv[0], [kidname, ...])
+  /usr/sbin/squid3 ix,
+
   # pinger
   network inet raw,
   network inet6 raw,