Thanks for the quick response!

After running update-guestfs-appliance the error message changed, so I was probably hitting a bug that was fixed already.

Now the failure is:

hactar% LANG= libguestfs-test-tool
===== Test starts here =====
LIBGUESTFS_DEBUG=1
TMPDIR=(not set)
libguestfs: new guestfs handle 0x808cd20
library version: 1.14.8
guestfs_get_append: (null)
guestfs_get_attach_method: appliance
guestfs_get_autosync: 1
guestfs_get_direct: 0
guestfs_get_memsize: 500
guestfs_get_network: 0
guestfs_get_path: /usr/lib/guestfs
guestfs_get_pgroup: 0
guestfs_get_qemu: /usr/bin/kvm
guestfs_get_recovery_proc: 1
guestfs_get_selinux: 0
guestfs_get_smp: 1
guestfs_get_trace: 0
guestfs_get_verbose: 1
host_cpu: i686
Launching appliance, timeout set to 600 seconds.
libguestfs: [00000ms] febootstrap-supermin-helper --verbose -f checksum '/usr/lib/guestfs/supermin.d' i686
supermin helper [00000ms] whitelist = (not specified), host_cpu = i686, kernel = (null), initrd = (null), appliance = (null)
supermin helper [00000ms] inputs[0] = /usr/lib/guestfs/supermin.d
checking modpath /lib/modules/3.2.0-54-generic-pae is a directory
picked vmlinuz-3.2.0-54-generic-pae because modpath /lib/modules/3.2.0-54-generic-pae exists
checking modpath /lib/modules/3.2.0-55-generic-pae is a directory
picked vmlinuz-3.2.0-55-generic-pae because modpath /lib/modules/3.2.0-55-generic-pae exists
checking modpath /lib/modules/3.2.0-51-generic-pae is a directory
picked vmlinuz-3.2.0-51-generic-pae because modpath /lib/modules/3.2.0-51-generic-pae exists
checking modpath /lib/modules/3.2.0-57-generic-pae is a directory
picked vmlinuz-3.2.0-57-generic-pae because modpath /lib/modules/3.2.0-57-generic-pae exists
checking modpath /lib/modules/3.2.0-56-generic-pae is a directory
picked vmlinuz-3.2.0-56-generic-pae because modpath /lib/modules/3.2.0-56-generic-pae exists
checking modpath /lib/modules/3.2.0-52-generic-pae is a directory
picked vmlinuz-3.2.0-52-generic-pae because modpath /lib/modules/3.2.0-52-generic-pae exists
checking modpath /lib/modules/3.2.0-53-generic-pae is a directory
picked vmlinuz-3.2.0-53-generic-pae because modpath /lib/modules/3.2.0-53-generic-pae exists
supermin helper [00000ms] finished creating kernel
supermin helper [00000ms] visiting /usr/lib/guestfs/supermin.d
supermin helper [00000ms] visiting /usr/lib/guestfs/supermin.d/base.img
supermin helper [00000ms] visiting /usr/lib/guestfs/supermin.d/daemon.img
supermin helper [00000ms] visiting /usr/lib/guestfs/supermin.d/hostfiles
supermin helper [00026ms] visiting /usr/lib/guestfs/supermin.d/init.img
supermin helper [00026ms] adding kernel modules
supermin helper [00071ms] finished creating appliance
libguestfs: [00073ms] begin testing qemu features
libguestfs: [00102ms] finished testing qemu features
libguestfs: accept_from_daemon: 0x808cd20 g->state = 1
[00103ms] /usr/bin/kvm \
    -global virtio-blk-pci.scsi=off \
    -drive file=/tmp/libguestfs-test-tool-sda-zaN1Cj,cache=off,format=raw,if=virtio \
    -nodefconfig \
    -machine accel=kvm:tcg \
    -nodefaults \
    -nographic \
    -m 500 \
    -no-reboot \
    -no-hpet \
    -device virtio-serial \
    -serial stdio \
    -chardev socket,path=/tmp/libguestfswgp32L/guestfsd.sock,id=channel0 \
    -device virtserialport,chardev=channel0,name=org.libguestfs.channel.0 \
    -kernel /var/tmp/.guestfs-1000/kernel.16390 \
    -initrd /var/tmp/.guestfs-1000/initrd.16390 \
    -append 'panic=1 console=ttyS0 udevtimeout=300 no_timer_check acpi=off printk.time=1 cgroup_disable=memory selinux=0 guestfs_verbose=1 TERM=screen ' \
    -drive file=/var/tmp/.guestfs-1000/root.16390,snapshot=on,if=virtio,cache=unsafeqemu: could not load kernel '/var/tmp/.guestfs-1000/kernel.16390': Permission denied
libguestfs: error: unexpected end of file when reading from daemon.
See earlier debug messages.
Or you can run 'libguestfs-test-tool' and post the complete output into
a bug report or message to the libguestfs mailing list.
libguestfs: child_cleanup: 0x808cd20: child process died
libguestfs-test-tool: failed to launch appliance
libguestfs: closing guestfs handle 0x808cd20 (state 0)

Here's the kernel symlink and its target permissions:

hactar% LANG= ls -l /var/tmp/.guestfs-1000/kernel.16390 /boot/vmlinuz-3.2.0-57-generic-pae 
-rw------- 1 root      root      4.8M Nov 12 21:00 /boot/vmlinuz-3.2.0-57-generic-pae
lrwxrwxrwx 3 bauermann bauermann   34 Dec 24 19:57 /var/tmp/.guestfs-1000/kernel.16390 -> /boot/vmlinuz-3.2.0-57-generic-pae

So the problem is that vmlinuz is readable only by root. These are the permissions of the files in /boot on my system:

hactar% LANG= ls -l /boot 
total 201M
-rw------- 1 root root 2.3M Jul 24 18:44 System.map-3.2.0-51-generic-pae
-rw------- 1 root root 2.3M Jul 26 14:46 System.map-3.2.0-52-generic-pae
-rw------- 1 root root 2.3M Aug 22 19:27 System.map-3.2.0-53-generic-pae
-rw------- 1 root root 2.3M Sep 10 18:32 System.map-3.2.0-54-generic-pae
-rw------- 1 root root 2.3M Oct  2 12:04 System.map-3.2.0-55-generic-pae
-rw------- 1 root root 2.3M Oct 23 16:54 System.map-3.2.0-56-generic-pae
-rw------- 1 root root 2.3M Nov 12 21:00 System.map-3.2.0-57-generic-pae
-rw-r--r-- 1 root root 786K Jul 24 18:44 abi-3.2.0-51-generic-pae
-rw-r--r-- 1 root root 786K Jul 26 14:46 abi-3.2.0-52-generic-pae
-rw-r--r-- 1 root root 786K Aug 22 19:27 abi-3.2.0-53-generic-pae
-rw-r--r-- 1 root root 786K Sep 10 18:32 abi-3.2.0-54-generic-pae
-rw-r--r-- 1 root root 787K Oct  2 12:04 abi-3.2.0-55-generic-pae
-rw-r--r-- 1 root root 787K Oct 23 16:54 abi-3.2.0-56-generic-pae
-rw-r--r-- 1 root root 787K Nov 12 21:00 abi-3.2.0-57-generic-pae
-rw-r--r-- 1 root root 145K Jul 24 18:44 config-3.2.0-51-generic-pae
-rw-r--r-- 1 root root 145K Jul 26 14:46 config-3.2.0-52-generic-pae
-rw-r--r-- 1 root root 145K Aug 22 19:27 config-3.2.0-53-generic-pae
-rw-r--r-- 1 root root 145K Sep 10 18:32 config-3.2.0-54-generic-pae
-rw-r--r-- 1 root root 145K Oct  2 12:04 config-3.2.0-55-generic-pae
-rw-r--r-- 1 root root 145K Oct 23 16:54 config-3.2.0-56-generic-pae
-rw-r--r-- 1 root root 145K Nov 12 21:00 config-3.2.0-57-generic-pae
drwxr-xr-x 3 root root 7.0K Dec 24 17:47 grub/
-rw-r--r-- 1 root root  21M Aug 21 00:43 initrd.img-3.2.0-51-generic-pae
-rw-r--r-- 1 root root  21M Aug 21 00:49 initrd.img-3.2.0-52-generic-pae
-rw-r--r-- 1 root root  21M Sep 11 22:48 initrd.img-3.2.0-53-generic-pae
-rw-r--r-- 1 root root  21M Oct  1 01:43 initrd.img-3.2.0-54-generic-pae
-rw-r--r-- 1 root root  21M Oct 31 01:32 initrd.img-3.2.0-55-generic-pae
-rw-r--r-- 1 root root  21M Nov 22 02:37 initrd.img-3.2.0-56-generic-pae
-rw-r--r-- 1 root root  21M Dec  3 16:38 initrd.img-3.2.0-57-generic-pae
drwx------ 2 root root  12K Feb 12  2012 lost+found/
-rw-r--r-- 1 root root 173K Nov 27  2011 memtest86+.bin
-rw-r--r-- 1 root root 175K Nov 27  2011 memtest86+_multiboot.bin
-rw------- 1 root root 4.8M Jul 24 18:44 vmlinuz-3.2.0-51-generic-pae
-rw------- 1 root root 4.8M Jul 26 14:46 vmlinuz-3.2.0-52-generic-pae
-rw------- 1 root root 4.8M Aug 22 19:27 vmlinuz-3.2.0-53-generic-pae
-rw------- 1 root root 4.8M Sep 10 18:32 vmlinuz-3.2.0-54-generic-pae
-rw------- 1 root root 4.8M Oct  2 12:04 vmlinuz-3.2.0-55-generic-pae
-rw------- 1 root root 4.8M Oct 23 16:54 vmlinuz-3.2.0-56-generic-pae
-rw------- 1 root root 4.8M Nov 12 21:00 vmlinuz-3.2.0-57-generic-pae

Changing vmlinuz's permission to 644 fixes guestfish for me.