inconsistent required directory rules needed with overlayfs

With only rules for the merged directory, I see the following denial when trying to do a directory listing on merged:

Jul 11 15:15:56 sec-xenial-amd64 kernel: audit: type=1400 audit(1499804156.009:72): apparmor="DENIED" operation="open" profile="test-profile" name="/tmp/tmp.4W0mxmOnDg/mnt/upper/" pid=2406 comm="ls" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

This can be solved with (note you need both since after allowing upper you see a denial for lower):
 /lower/{,**/} r,
 /upper/{,**/} r,

Curiously, file rules are not needed and you can read files in merged without lower or upper rules.

Reproducer:
$ tar -zxvf ./overlay-requires-rules-for-lower-and-upper-with-dir-listing.tar.gz && sudo ./overlay-requires-rules-for-lower-and-upper-with-dir-listing/drv
overlay-requires-rules-for-lower-and-upper-with-dir-listing/
overlay-requires-rules-for-lower-and-upper-with-dir-listing/p.in
overlay-requires-rules-for-lower-and-upper-with-dir-listing/overlay.c
overlay-requires-rules-for-lower-and-upper-with-dir-listing/drv
overlay-requires-rules-for-lower-and-upper-with-dir-listing/tst
Created tmpdir '/tmp/tmp.4W0mxmOnDg'

Ubuntu 4.4.0-83.106-generic 4.4.70

Disabling kernel rate-limiting
kernel.printk_ratelimit = 0

Loading /tmp/tmp.4W0mxmOnDg/data/p

chdir(/tmp/tmp.4W0mxmOnDg/mnt)

Creating the overlay directories
- mkdir /tmp/tmp.4W0mxmOnDg/mnt/lower
- mkdir /tmp/tmp.4W0mxmOnDg/mnt/upper
- mkdir /tmp/tmp.4W0mxmOnDg/mnt/work
- mkdir /tmp/tmp.4W0mxmOnDg/mnt/merged

Populating /tmp/tmp.4W0mxmOnDg/mnt/lower
- /tmp/tmp.4W0mxmOnDg/mnt/lower/test-lower

Populating /tmp/tmp.4W0mxmOnDg/mnt/upper
- /tmp/tmp.4W0mxmOnDg/mnt/upper/test-upper

Perform the overlay
lower=/tmp/tmp.4W0mxmOnDg/mnt/lower
upper=/tmp/tmp.4W0mxmOnDg/mnt/upper
work=/tmp/tmp.4W0mxmOnDg/mnt/work
where=/tmp/tmp.4W0mxmOnDg/mnt/merged
exe=/tmp/tmp.4W0mxmOnDg/data/tst
- mount('overlay', '/tmp/tmp.4W0mxmOnDg/mnt/merged', 'overlay', MS_MGC_VAL, lowerdir=/tmp/tmp.4W0mxmOnDg/mnt/lower,upperdir=/tmp/tmp.4W0mxmOnDg/mnt/upper,workdir=/tmp/tmp.4W0mxmOnDg/mnt/work
 - success
starting '/tmp/tmp.4W0mxmOnDg/data/tst'

Testing files in overlay
 - test read file from lower
 - test read file from upper
 - test list dir on ./merged
ls: cannot open directory './merged': Permission denied
FAIL: could not read from ./merged/test-upper

Cleaning up
- umount /tmp/tmp.4W0mxmOnDg/mnt/merged
- rm -rf /tmp/tmp.4W0mxmOnDg