This fixes a bug that causes a crash in podman. Podman uses signal to communicate with pasta. Without this patch apparmor does not allow podman to signal pasta and kills pasta instead. Killing pasta causes podman to crash. You can reproduce this by starting a rootless podman socket and starting a container via the socket using podman remote or docker. Links: https://bugs.launchpad.net/ubuntu/+source/passt/+bug/2154379 Signed-off-by: Jan Philipp Bittner --- contrib/apparmor/usr.bin.pasta | 3 +++ 1 file changed, 3 insertions(+) diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta index 56b5024..b0838de 100644 --- a/contrib/apparmor/usr.bin.pasta +++ b/contrib/apparmor/usr.bin.pasta @@ -18,6 +18,9 @@ include profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) { include + # Allow podman to signal pasta + signal (receive) peer=podman, + # Alternatively: include /tmp/** rw, # tap_sock_unix_open(), # tap_sock_unix_init(), pcap(), -- 2.43.0