From ec9b2d0ee034accc291b21bc27f6a7e9fb01158c Mon Sep 17 00:00:00 2001 From: Dmitrii Korzhimanov Date: Wed, 15 Apr 2026 18:23:31 +0200 Subject: [PATCH 1/2] fix(modulefinder): handle ENOSYS in read_safely for K8s seccomp Kubernetes RuntimeDefault seccomp profiles block `process_vm_readv` and return ENOSYS (errno=38). The existing fallback only handled EPERM and EINVAL, so every ELF module validation failed silently, leaving `debug_meta.images` empty in manually-captured events and causing all stack frames to show as `unknown_image` in Sentry. Add ENOSYS to the fallback so the memcpy path is taken when the syscall is unavailable, matching the behaviour already in place for EPERM/EINVAL. --- src/modulefinder/sentry_modulefinder_linux.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/modulefinder/sentry_modulefinder_linux.c b/src/modulefinder/sentry_modulefinder_linux.c index a826bb7bf3..46f85b341c 100644 --- a/src/modulefinder/sentry_modulefinder_linux.c +++ b/src/modulefinder/sentry_modulefinder_linux.c @@ -141,9 +141,13 @@ read_safely(void *dst, void *src, size_t size) // See https://github.com/getsentry/sentry-native/issues/578). // Also, the syscall is only available in Linux 3.2, meaning Android 17. // In that case we get an `EINVAL`. + // Additionally, Kubernetes default seccomp profiles (RuntimeDefault) block + // `process_vm_readv` and return `ENOSYS`, causing all ELF module + // validations to fail and `debug_meta.images` to be absent from + // manually-captured events. // - // In either of these cases, just fall back to an unsafe `memcpy`. - if (!rv && (errno == EPERM || errno == EINVAL)) { + // In any of these cases, just fall back to an unsafe `memcpy`. + if (!rv && (errno == EPERM || errno == EINVAL || errno == ENOSYS)) { memcpy(dst, src, size); rv = true; } From 2d8fdc3a5a512d44e86edcebe04ae860b74d73ca Mon Sep 17 00:00:00 2001 From: Dmitrii Korzhimanov Date: Thu, 16 Apr 2026 12:56:41 +0200 Subject: [PATCH 2/2] address review: tighten comment and add changelog entry --- CHANGELOG.md | 6 ++++++ src/modulefinder/sentry_modulefinder_linux.c | 7 +++---- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3cc1e2d598..0aee5f006a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## Unreleased + +**Fixes**: + +- Linux: handle `ENOSYS` in `read_safely` to fix empty module list in seccomp-restricted environments. ([#1655](https://github.com/getsentry/sentry-native/pull/1655)) + ## 0.13.7 **Features**: diff --git a/src/modulefinder/sentry_modulefinder_linux.c b/src/modulefinder/sentry_modulefinder_linux.c index 46f85b341c..2d65107583 100644 --- a/src/modulefinder/sentry_modulefinder_linux.c +++ b/src/modulefinder/sentry_modulefinder_linux.c @@ -141,10 +141,9 @@ read_safely(void *dst, void *src, size_t size) // See https://github.com/getsentry/sentry-native/issues/578). // Also, the syscall is only available in Linux 3.2, meaning Android 17. // In that case we get an `EINVAL`. - // Additionally, Kubernetes default seccomp profiles (RuntimeDefault) block - // `process_vm_readv` and return `ENOSYS`, causing all ELF module - // validations to fail and `debug_meta.images` to be absent from - // manually-captured events. + // Additionally, in some seccomp-restricted environments, + // `process_vm_readv` may be unavailable and fail with `ENOSYS` (see + // https://github.com/getsentry/sentry-native/issues/1653). // // In any of these cases, just fall back to an unsafe `memcpy`. if (!rv && (errno == EPERM || errno == EINVAL || errno == ENOSYS)) {