{"record":{"id":"795ce79b8f5ab946","repo":"tauri-apps/tauri","slug":"failed-to-get-random-bytes","errorCode":null,"errorMessage":"failed to get random bytes","messagePattern":"failed to get random bytes","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tauri/src/manager/mod.rs","lineNumber":135,"sourceCode":"  for (start, part) in original.match_indices(pattern) {\n    result.push_str(unsafe { original.get_unchecked(last_end..start) });\n    result.push_str(&replacement());\n    last_end = start + part.len();\n  }\n  result.push_str(unsafe { original.get_unchecked(last_end..original.len()) });\n  result\n}\n\nfn replace_csp_nonce(\n  asset: &mut String,\n  token: &str,\n  csp: &mut HashMap<String, CspDirectiveSources>,\n  directive: &str,\n  hashes: Vec<String>,\n) {\n  let mut nonces = Vec::new();\n  *asset = replace_with_callback(asset, token, || {\n    let nonce = getrandom::u64().expect(\"failed to get random bytes\");\n    nonces.push(nonce);\n    nonce.to_string()\n  });\n\n  if !(nonces.is_empty() && hashes.is_empty()) {\n    let nonce_sources = nonces\n      .into_iter()\n      .map(|n| format!(\"'nonce-{n}'\"))\n      .collect::<Vec<String>>();\n    let sources = csp.entry(directive.into()).or_default();\n    let self_source = \"'self'\".to_string();\n    if !sources.contains(&self_source) {\n      sources.push(self_source);\n    }\n    sources.extend(nonce_sources);\n    sources.extend(hashes);\n  }\n}","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/tauri-apps/tauri/blob/52e4b6e71d8632a7e648f866c442e287ecddee34/crates/tauri/src/manager/mod.rs#L117-L153","documentation":"When the app defines a CSP, Tauri generates per-request nonces with getrandom::u64() while rewriting served HTML. The expect fires when the OS entropy source fails: the getrandom syscall / /dev/urandom is unavailable, e.g. under restrictive seccomp or gVisor sandboxes, a broken /dev/urandom, or a kernel too old for getrandom without the urandom fallback.","triggerScenarios":"Running an app with CSP nonce injection inside a container/sandbox that blocks the getrandom(2) syscall and access to /dev/urandom, or on a minimal embedded image lacking them.","commonSituations":"Over-restricted Docker/seccomp profiles; gVisor runtimes; custom minimal Linux images. Virtually never on normal desktop OSes.","solutions":["Allow the getrandom(2) syscall (and /dev/urandom access) in the sandbox/seccomp profile.","Use a standard base image or a newer kernel.","Nothing app-level fixes it: OS entropy access is required for CSP nonces."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// probe entropy at startup to fail fast with a clear message\nlet mut probe = [0u8; 8];\nif getrandom::fill(&mut probe).is_err() {\n    return Err(\"OS entropy unavailable - allow getrandom(2)/dev/urandom in the sandbox\".into());\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Allow the getrandom(2) syscall and /dev/urandom in seccomp/container profiles.","Test apps in the actual deployment sandbox, not just on the desktop.","Use standard base images with working entropy sources."],"tags":["tauri","csp","nonce","getrandom","sandbox","entropy"],"backgroundTag":"os-entropy-unavailable","analyzedSha":"52e4b6e71d8632a7e648f866c442e287ecddee34","analyzedAt":"2026-08-20T13:59:20.734Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}