Comment 6 for bug 470636

While this is technically different than 'kvm snapshot', this is actually what I meant by 'snapshotting'. The problem is that there is nothing in your XML that shows that there is a base image in use (or a cow file for that matter). This is not expressed in your XML with the backing store being managed outside of libvirt, and therefore cannot be captured by the security driver.

The support that was added in 0.6.0 was for a backingstore when using a storage volume (see http://libvirt.org/formatstorage.html#StorageVolBacking). At this time, the AppArmor security driver does not support a backing store, but will in a future release. I'll update the bug accordingly.