Comment 2 for bug 173709

You can either manually edit the klogd profile or use the profiling tool logprof.

> logprof /sbin/klogd

logprof should scan your log file and find the reject and then ask to add "r" permission for /proc/kallsyms, saying
yes will allow this and then you can save and place the profile in enforce mode.

Alternately if you hand edit the profile it is "/etc/apparmor.d/sbin.klogd", you will need to add the following rule
  /proc/kallsyms r,

I am unsure why AppArmor stopping klogd from accessing /proc/kallsyms would cause KDM or other services to fail unless they are dependent on klogd. I am not very familiar with upstart so I can't say if this is the case at the moment. I will look into it and see what I can find.