Skip to content

tests/functional: skip the sentry test when Yama restricts ptrace - #625

Merged
edolstra merged 1 commit into
DeterminateSystems:mainfrom
Reasonable-Solutions:skip-sentry-test-under-yama
Sep 4, 2026
Merged

tests/functional: skip the sentry test when Yama restricts ptrace#625
edolstra merged 1 commit into
DeterminateSystems:mainfrom
Reasonable-Solutions:skip-sentry-test-under-yama

Conversation

@Reasonable-Solutions

@Reasonable-Solutions Reasonable-Solutions commented Sep 4, 2026

Copy link
Copy Markdown

Afaik sentry has similar handling upstream: https://github.com/getsentry/sentry-native/blob/0.13.5/src/backends/sentry_backend_native.c#L372-L379

Observed as a deterministic nix-functional-tests:sentry failure when building determinate-nix inside an unprivileged CI sandbox on a hardened host (Talos Linux, ptrace_scope=2), while the same derivation builds clean on a workstation with ptrace_scope=1.

Summary by CodeRabbit

  • Bug Fixes
    • Improved Sentry crash-test compatibility on systems with restrictive kernel tracing settings by skipping the test when crash dump capture is unavailable.

The crashpad handler writes a crash's minidump by ptrace-attaching to
the crashing process. With kernel.yama.ptrace_scope >= 2 ptrace is
reserved for CAP_SYS_PTRACE, which an unprivileged test run does not
have (PR_SET_PTRACER only helps at scope 1), so no dump can ever be
captured and every crash type fails with 'No crash dump found'. Skip
the test on such kernels, matching the existing per-platform skips.

Observed as a deterministic nix-functional-tests:sentry failure when
building determinate-nix inside an unprivileged CI sandbox on a
hardened host (Talos Linux, ptrace_scope=2), while the same derivation
builds clean on a workstation with ptrace_scope=1.
@coderabbitai

coderabbitai Bot commented Sep 4, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 7f5fbbc1-acf3-47fd-83c7-d9ab5292adf9

📥 Commits

Reviewing files that changed from the base of the PR and between 3ed5caa and 29f34c5.

📒 Files selected for processing (1)
  • tests/functional/sentry.sh

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

The Sentry crash test now checks /proc/sys/kernel/yama/ptrace_scope and skips when its readable value is at least 2.

Changes

Sentry crash test

Layer / File(s) Summary
Yama ptrace eligibility guard
tests/functional/sentry.sh
The test skips when Yama ptrace_scope is readable and has a value of at least 2.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 29f34

The Sentry functional test now skips only when restrictive readable Yama ptrace settings prevent crash dump capture; no current merge-blocking risk remains.

Suggested reviewers: edolstra

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: skipping the Sentry test when Yama restricts ptrace access.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
  • Fix all pre-merge checks with AI
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@edolstra
edolstra enabled auto-merge September 4, 2026 13:17
@edolstra
edolstra added this pull request to the merge queue Sep 4, 2026
Merged via the queue into DeterminateSystems:main with commit cbbde97 Sep 4, 2026
32 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants