Unfortunately, it seems the error code of aa_change_onexec is not propagated, which is a bug ( my fault, will correct upstream ). In the mean time, I guess we will have to use strace and/or gdb to get it and see what is going on. I will try to take a look later, once I can find a VM to debug it.