$ test-policy-app.raw-usb
2017/11/02 15:42:03.844071 main.go:130: cannot change mount namespace of snap "test-policy-app" according to change mount (/var/lib/snapd/hostfs/usr/local/share/fonts /usr/local/share/fonts none bind,ro 0 0): permission denied
2017/11/02 15:42:03.845453 main.go:130: cannot change mount namespace of snap "test-policy-app" according to change mount (/var/lib/snapd/hostfs/usr/share/fonts /usr/share/fonts none bind,ro 0 0): permission denied
2017/11/02 15:42:03.845485 main.go:130: cannot change mount namespace of snap "test-policy-app" according to change mount (/var/lib/snapd/hostfs/var/cache/fontconfig /var/cache/fontconfig none bind,ro 0 0): permission denied


AppArmor denial:
apparmor="DENIED" operation="mount" info="failed mntpnt match" error=-13 profile="/snap/core/3357/usr/lib/snapd/snap-confine//snap_update_ns" name="/var/cache/fontconfig/" pid=28915 comm="5" srcname="/var/lib/snapd/hostfs/var/cache/fontconfig/" flags="rw, bind"