Comment 3 for bug 1670901

Hmm, that's half an answer ;-)

The profile you pasted (BTW: file name/location?) defines several hats, but you didn't paste the /bin/su profile itsself. Can you please add that?
If in doubt and none of your profiles has something you want to keep secret, please attach a tarball of /etc/apparmor.d/ (or mail it to me if you prefer not to have it on launchpad)