/proc/sys/kernel/random/boot_id is part of nameservice-strict.

apparmor.d/groups/virt/cockpit-bridge

@@ -50,7 +50,6 @@ profile cockpit-bridge @{exec_path} {
         @{PROC}/1/cgroup r,
         @{PROC}/cmdline r,
         @{PROC}/diskstats r,
-        @{PROC}/sys/kernel/random/boot_id r,
         @{PROC}/uptime r,
 
   /dev/ptmx rw,

apparmor.d/groups/virt/cockpit-session

@@ -43,7 +43,6 @@ profile cockpit-session @{exec_path} flags=(attach_disconnected) {
   owner @{PROC}/@{pid}/loginuid rw,
   owner @{PROC}/@{pid}/uid_map r,
         @{PROC}/@{pids}/fd/ r,
-        @{PROC}/sys/kernel/random/boot_id r,
 
   include if exists <local/cockpit-session>
 }