I tripped over this problem recently with an instance that needed its neutron port recreated.
At some point the apparmor profile was regenerated while the instance lacked a network interface and so the permission required to reattach it was lost.
I ended up editing and reloading the profile manually, although re-running virt-aa-helper in a suitable manner would probably have been simpler and safer -- had I known it existed.
I tripped over this problem recently with an instance that needed its neutron port recreated.
At some point the apparmor profile was regenerated while the instance lacked a network interface and so the permission required to reattach it was lost.
I ended up editing and reloading the profile manually, although re-running virt-aa-helper in a suitable manner would probably have been simpler and safer -- had I known it existed.