From 0de7077b196c738d4d1f0e7c06189fbe8fa9814d Mon Sep 17 00:00:00 2001 From: Dmitrii Korzhimanov Date: Wed, 15 Apr 2026 18:23:31 +0200 Subject: [PATCH] fix(modulefinder): handle ENOSYS in read_safely for K8s seccomp Kubernetes RuntimeDefault seccomp profiles block `process_vm_readv` and return ENOSYS (errno=38). The existing fallback only handled EPERM and EINVAL, so every ELF module validation failed silently, leaving `debug_meta.images` empty in manually-captured events and causing all stack frames to show as `unknown_image` in Sentry. Add ENOSYS to the fallback so the memcpy path is taken when the syscall is unavailable, matching the behaviour already in place for EPERM/EINVAL. --- src/modulefinder/sentry_modulefinder_linux.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/modulefinder/sentry_modulefinder_linux.c b/src/modulefinder/sentry_modulefinder_linux.c index a826bb7bf3..46f85b341c 100644 --- a/src/modulefinder/sentry_modulefinder_linux.c +++ b/src/modulefinder/sentry_modulefinder_linux.c @@ -141,9 +141,13 @@ read_safely(void *dst, void *src, size_t size) // See https://github.com/getsentry/sentry-native/issues/578). // Also, the syscall is only available in Linux 3.2, meaning Android 17. // In that case we get an `EINVAL`. + // Additionally, Kubernetes default seccomp profiles (RuntimeDefault) block + // `process_vm_readv` and return `ENOSYS`, causing all ELF module + // validations to fail and `debug_meta.images` to be absent from + // manually-captured events. // - // In either of these cases, just fall back to an unsafe `memcpy`. - if (!rv && (errno == EPERM || errno == EINVAL)) { + // In any of these cases, just fall back to an unsafe `memcpy`. + if (!rv && (errno == EPERM || errno == EINVAL || errno == ENOSYS)) { memcpy(dst, src, size); rv = true; }