Comment 0 for bug 1634753

This came up in snapd spread tests but can be reproduced with:

In an i386 up to date 16.04 VM:

1. in one terminal, run this:

$ cat changehat_reproducer.sh
#!/bin/sh
set -e
sudo sysctl -w kernel.printk_ratelimit=0
sudo snap install hello-world || true

count=0
while /bin/true ; do
    count=$((count+1))
    if [ `echo "$count % 100" | bc` -eq 0 ]; then
        echo "$count runs"
    fi
    hello-world > /dev/null || {
      tail -100 /var/log/syslog | grep DEN && exit
    }
    sudo cat /run/snapd/ns/hello-world.mnt 2>/dev/null || sudo /usr/lib/snapd/snap-discard-ns hello-world
done

2. in another terminal run:
$ while do /bin/true ; sudo apparmor_parser -r /etc/apparmor.d/* >/dev/null 2>&1 ; done

3. In another terminal:
$ tail -f /var/log/syslog|grep DEN

This is not limited to i386.