I can confirm that this issue also affects Ubuntu 26.04 on ARM64
(aarch64).
Environment:
Ubuntu 26.04 (Resolute), ARM64
Podman: 5.7.0+ds2-3build1
passt: 0.0~git20260120.386b5f5-1
AppArmor: 5.0.2-0ubuntu1~26.04.1
When running podman-compose down -v with rootless Podman, I encountered:
Error: removing container ... network: 1 error occurred:
* rootless netns: kill network process: permission denied
The kernel audit log confirms the AppArmor denial:
apparmor="DENIED" operation="signal" class="signal" profile="pasta"
comm="podman" requested_mask="receive" denied_mask="receive" signal=term
peer="podman"
Workaround confirmed:
Adding the following rule inside /etc/apparmor.d/usr.bin.pasta and
reloading the profile resolved the issue:
signal (receive) set=(term) peer=podman,
After applying this change, podman-compose down -v works correctly.
I also noticed that Debian encountered the same issue in Debian Bug
#1100135, which was fixed in apparmor 4.1.0~beta5-4 by removing the
Podman stub profile.
Ubuntu 26.04 still ships /etc/apparmor.d/podman, so the same conflict
appears to remain.
Is there any plan to incorporate a permanent fix into Ubuntu 26.04,
either by adopting Debian's approach or implementing the dedicated pasta
profile transition discussed above?
Thanks!
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2154379
Title:
pasta is not allowed to receive signals from podman due to apparmor
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2154379/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
