`pasta` fails to start on AppArmor enabled Debian/Ubuntu/openSUSE

[p2004a]

Debian/Ubuntu/openSUSE AppArmor profiles (https://salsa.debian.org/sbrivio/passt/-/blob/master/contrib/apparmor/usr.bin.pasta) allow pasta to write only to /tmp/**. Drop tries to put log and pid file under run dir under XDG_DATA_HOME so startup fails with error like:

Error: wait for pasta to start: exit status 1

Pasta stderr:
Couldn't open log file /home/p2004a/.local/share/drop/internal/run/rapid-build-rework-163994012/pasta.log: Permission denied

[wrr]

Thanks. I've encountered a similar issue on Fedora, but it was due to SELinux, not AppArmor. Which Ubuntu version has this problem? I'm using Ubuntu 24, which has AppArmor enabled but does not install a profile for pasta.

For Fedora, Drop documents how to fix the SELinux (but not AppArmor) problem here: https://github.com/wrr/drop#fedora---selinux-config, but this is rather involved. Because more systems are affected, I'll check the feasibility of moving these files to /tmp/, so no additional configuration would be needed.

[p2004a]

I'm on Debian Sid, here the profile is part of the package, installed with it:

$ apt-file search /etc/apparmor.d/usr.bin.pasta
passt: /etc/apparmor.d/usr.bin.pasta