[HrMathematiker]

Fixes #1653.

Problem

When running under Kubernetes with the default RuntimeDefault seccomp profile, process_vm_readv is blocked and returns ENOSYS (errno 38). The existing fallback in read_safely() only handles EPERM and EINVAL, so every ELF module validation fails silently.

The result: sentry_get_modules_list() returns 0 modules, debug_meta.images is absent from manually-captured events, and every stack frame shows as unknown_image in Sentry — even when debug symbols have been uploaded correctly.

When does this happen?

• Kubernetes pods using the default RuntimeDefault seccomp profile
• Docker containers (Docker default profile returns EPERM, already handled)
• Bare-metal / VMs (syscall is permitted)

Crash events via crashpad are not affected because the out-of-process handler enumerates modules from /proc/<pid>/maps directly, independent of sentry_get_modules_list().

Root cause

read_safely() in sentry_modulefinder_linux.c:

// Before
if (!rv && (errno == EPERM || errno == EINVAL)) {

// After
if (!rv && (errno == EPERM || errno == EINVAL || errno == ENOSYS)) {

Verification

Confirmed with a static test binary copied into a real K8s pod (Flatcar Linux, kernel 6.12, Seccomp: 2):

FAILED: errno=38 (Function not implemented)

Also reproduced locally using Docker with a custom seccomp profile (SCMP_ACT_ERRNO / errnoRet: 38) — the original code fails, the patched code falls back to memcpy and succeeds.

Fix

One-liner: add || errno == ENOSYS to the existing errno fallback. The address is valid in-process memory, so memcpy is safe.

[sdk-maintainer-bot]

This PR has been automatically closed. All non-maintainer contributions must reference an existing GitHub issue.

Next steps:

1. Find or open an issue describing the problem or feature
2. Discuss the approach with a maintainer in the issue
3. Once a maintainer has acknowledged your proposed approach, open a new PR referencing the issue

Please review our contributing guidelines for more details.