Please also check if some running services run without their AppArmor
profile. You can see this in aa-status in the section "... processes
are unconfined but have a profile defined". Please restart any services
listed there, or simply reboot.
If someone has an idea how to fix this on the packaging level, please
tell me ;-)
 It probably has to do with (re)adding the missing apparmor.service
to the package - but I have no idea why the presets don't
automatically enable apparmor.service.
> Surely SUSE need to also get SLED 12 working on hardware that new?
I'd like to avoid to answer this question, next please! :)
[> Richard Brown and Takashi Iwai in opensuse-factory]