diff --git a/apparmor/session-lockdown/no-deny b/apparmor/session-lockdown/no-deny
index 25a16d13817af9fe09ef6fdd0812db6ad69e49d9..6d02e7757ae67508fa17b57f0aa12fcfda599ee6 100755
--- a/apparmor/session-lockdown/no-deny
+++ b/apparmor/session-lockdown/no-deny
@@ -111,7 +111,7 @@ def find_apparmorfs():
             return os.path.join(p.split()[1].decode(), "apparmor")
     return False
 
-def log_subprocess(*argv):
+def log_subprocess(*argv, may_fail=False):
     with subprocess.Popen(argv, stdin=subprocess.DEVNULL,
             stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
             universal_newlines=True) as proc:
@@ -124,6 +124,11 @@ def log_subprocess(*argv):
 
         print('#\\--')
         print('# -> exit status {}'.format(proc.wait()))
+
+        if proc.returncode != 0 and not may_fail:
+            raise AssertionError('{!r} returned {}'.format(argv,
+                proc.returncode))
+
         return proc.returncode
 
 def before_reboot():