The coverage step runs cargo tarpaulin with its default Linux ptrace engine, which calls personality(ADDR_NO_RANDOMIZE) to disable ASLR before launching the test binary. On a self-hosted runner whose container seccomp profile blocks personality() and/or whose host kernel is hardened, that returns EPERM:

cargo_tarpaulin: Failed to run tests: ASLR disable failed: EPERM: Operation not permitted

(Observed on run 780388a8d3, job ‘coverage’; check/test/fmt passed.)

This is tarpaulin requesting a privilege the sandbox correctly denies — not a runner problem.

Fix

Use tarpaulin’s LLVM source-based coverage engine (--engine llvm), which instruments via -C instrument-coverage and never ptraces / disables ASLR. Add rustup component add llvm-tools-preview so the engine has llvm-profdata/llvm-cov.