The error messages you get are NOT helpful in allowing you to figure out what just went wrong, so if you don't know about it there's a huge cognitive gap because things that SHOULD work just don't for no valid reason.

Denials by AppArmor (or any other ACL addition) really should have a more verbose diagnostic message AND a dedicated ERRNO that is different from the standard ones.

This can also cause a bunch of fun errors (on installation no less) when you have custom PAM plugins. At least last time I had to deal with that (might have been as long ago as 12.04).