v0.24.1: Tracee gRPC server tries to marshal invalid UTF-8 in strings

[francescom-zenity]

Description

I'm attaching a grpcurl instance to the Tracee gRPC server (tracee.v1beta1.TraceeService.StreamEvents RPC) and I noticed grpcurl often dies with

ERROR:
  Code: Internal
  Message: grpc: error while marshaling: string field contains invalid UTF-8

I think Tracee gRPC server should implement more validation/sanitization of raw syscall arguments (like read/write buffers, paths, argv) that land into grpc string fields. Anything binary (ELF bytes, compressed data, UTF-16 paths, random memory) blows up marshaling...

Output of tracee version:

v0.24.1

Output of uname -a:

Linux agentbox 6.8.0-106-generic #106-Ubuntu SMP PREEMPT_DYNAMIC Fri Mar  6 07:58:08 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux

Additional details

[francescom-zenity]

After some long and boring bisection work I got to the point where I'm confident that the presence of getsockname in the event list is triggering the described behavior grpc: error while marshaling: string field contains invalid UTF-8.

Initially I was enabling the net_sock event set; I expanded it and done some bisection to get to this conclusion.

I didn't dig further in Tracee code to understand why getsockname arguments (sockaddr_t) would cause such issues during marshalling... I just excluded getsockname to work around this bug

[geyslan]

@francescom-zenity thanks for opening this. Your found may relate to this #5298.

[geyslan]

Could you fetch this #5299 into 24.1 and see if it solves this issue?