From e30435fc72894b29f654d67cb2ab6b6f0fd723b9 Mon Sep 17 00:00:00 2001
From: Evan Lezar <elezar@nvidia.com>
Date: Mon, 24 Aug 2026 13:57:23 +0200
Subject: [PATCH 1/3] fix(ci): allow pasta to receive Podman stop signals

Signed-off-by: Evan Lezar <elezar@nvidia.com>
---
 .github/workflows/e2e-test.yml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index 006f5cf440..4aae61abe3 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -197,6 +197,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
+            apparmor \
             build-essential \
             clang \
             fuse-overlayfs \
@@ -219,6 +220,20 @@ jobs:
           echo "/usr/bin" >> "${GITHUB_PATH}"
           echo "CONTAINERS_CONF_OVERRIDE=${podman_config}" >> "${GITHUB_ENV}"
 
+      - name: Allow pasta to receive Podman stop signals
+        # Ubuntu's packaged pasta profile currently blocks this signal, forcing
+        # Podman to wait for its SIGKILL fallback. Keep this narrow allowance
+        # until the distribution package includes the upstream profile fix.
+        run: |
+          set -euo pipefail
+          profile=/etc/apparmor.d/usr.bin.pasta
+          rule='  signal (receive) peer=podman,'
+          if ! sudo grep -Fqx "${rule}" "${profile}"; then
+            sudo sed -i '\|^  include <abstractions/pasta>$|a\  signal (receive) peer=podman,' "${profile}"
+          fi
+          sudo grep -Fqx "${rule}" "${profile}"
+          sudo apparmor_parser --replace "${profile}"
+
       - name: Configure rootless Podman
         run: |
           set -euo pipefail

From 52199a8f23e2b4aefc2027d87200c8b488fb143c Mon Sep 17 00:00:00 2001
From: Evan Lezar <elezar@nvidia.com>
Date: Tue, 25 Aug 2026 09:56:08 +0200
Subject: [PATCH 2/3] test(ci): fail on pasta SIGTERM denial

Signed-off-by: Evan Lezar <elezar@nvidia.com>
---
 .github/workflows/e2e-test.yml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index 4aae61abe3..663acfd116 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -290,9 +290,16 @@ jobs:
       - name: Run Podman E2E
         run: ${{ matrix.cmd }}
 
-      - name: Print AppArmor denials
+      - name: Fail on pasta SIGTERM AppArmor denial
         if: always()
-        run: sudo dmesg | grep -E 'apparmor=.*DENIED|profile="unprivileged_userns"' | tail -100 || true
+        run: |
+          set -euo pipefail
+          denials="$(sudo dmesg | grep -E 'profile="pasta".*requested_mask="receive".*signal=term.*peer="podman"' || true)"
+          if [ -n "${denials}" ]; then
+            echo "::error::pasta denied Podman's SIGTERM; Podman will use its SIGKILL fallback"
+            printf '%s\n' "${denials}"
+            exit 1
+          fi
 
   e2e-vm:
     name: E2E (rust-vm-${{ matrix.suite }})

From 008d250593b52fd682cdecdf4ca1ecfce98fcda5 Mon Sep 17 00:00:00 2001
From: Evan Lezar <elezar@nvidia.com>
Date: Tue, 25 Aug 2026 09:57:26 +0200
Subject: [PATCH 3/3] test(ci): retain AppArmor denial diagnostics

Signed-off-by: Evan Lezar <elezar@nvidia.com>
---
 .github/workflows/e2e-test.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index 663acfd116..3e6a972874 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -290,6 +290,10 @@ jobs:
       - name: Run Podman E2E
         run: ${{ matrix.cmd }}
 
+      - name: Print AppArmor denials
+        if: always()
+        run: sudo dmesg | grep -E 'apparmor=.*DENIED|profile="unprivileged_userns"' | tail -100 || true
+
       - name: Fail on pasta SIGTERM AppArmor denial
         if: always()
         run: |