Code review comment for lp://staging/~jamesh/thumbnailer/use-aa-query-label

Here is the steps I went to test this on the phone after installing it:

1. run "sudo aa-status" to find the list of profiles installed on the system. I looked for the label for the gallery app, which in this case was "com.ubuntu.gallery_gallery_2.9.1.1183"

2. Copy an image to ~/.local/share/com.ubuntu.music (or any other app-specific directory).

3. Change to ~/.local/share/com.ubuntu.gallery (a directory the profile from (1) could write to).

4. Run the following command (adjusting for exact label name):

   aa-exec -p com.ubuntu.gallery_gallery_2.9.1.1183 thumbnailer-admin get \
       ~/.local/share/com.ubuntu.music/image.jpg .

I then received the following error message:

thumbnailer-admin: checkFinished(): thumbnail: /home/phablet/.local/share/com.ubuntu.music/image20150602_014415108.jpg (0,0): unity::ResourceException: RequestBase::thumbnail(): key = /home/phablet/.local/share/com.ubuntu.music/image20150602_014415108.jpg\0145638\01434511100.933353751\01434511100.933353751:
    LocalThumbnailRequest::fetch(): AppArmor policy forbids access to /home/phablet/.local/share/com.ubuntu.music/image20150602_014415108.jpg

(plus a bunch of output complaining that it couldn't write to .gcda files, since this was a coverage build).