Interestingly this is a very similar primitive to one of the "unexploitable" dead ends in
@trailofbits recent article about sandbox escapes. (although this is a slightly different bug)
It did take some manual nudging for me to convince 5.6-sol that AppArmor could be bypassed :)