{"record":{"id":"396a6e1114b15f31","repo":"semaphoreui/semaphore","slug":"failed-to-set-no-new-privs-w","errorCode":null,"errorMessage":"failed to set no_new_privs: %w","messagePattern":"failed to set no_new_privs: %w","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/config.go","lineNumber":912,"sourceCode":"\tConfig.Apps = map[string]App{}\n\n\tif !noConfigFile {\n\t\tusedConfigPath = loadConfigFile(configPath)\n\t}\n\n\tloadConfigEnvironment()\n\tloadConfigDefaults()\n\n\t// Resolve encryption keyrings (read key files, apply precedence, build the\n\t// runtime keyrings) before validation consumes the keys.\n\tresolveEncryptionKeys()\n\n\t//fmt.Println(\"Validating config\")\n\tvalidateConfig()\n\n\tif Config.Process.NoNewPrivs {\n\t\tif err := SetNoNewPrivs(); err != nil {\n\t\t\tpanic(fmt.Errorf(\"failed to set no_new_privs: %w\", err))\n\t\t}\n\t}\n\n\tvar encryption []byte\n\n\thash, _ := base64.StdEncoding.DecodeString(Config.CookieHash)\n\tif len(Config.CookieEncryption) > 0 {\n\t\tencryption, _ = base64.StdEncoding.DecodeString(Config.CookieEncryption)\n\t}\n\n\tCookie = securecookie.New(hash, encryption)\n\n\tif Config.WebHost != \"\" {\n\t\tvar err error\n\t\tWebHostURL, err = url.Parse(Config.WebHost)\n\t\tif err != nil {\n\t\t\tpanic(err)\n\t\t}","sourceCodeStart":894,"sourceCodeEnd":930,"githubUrl":"https://github.com/semaphoreui/semaphore/blob/1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa/util/config.go#L894-L930","documentation":"Panics from ConfigInit in util/config.go when the process-wide NO_NEW_PRIVS prctl flag is enabled in the config (Config.Process.NoNewPrivs) but the SetNoNewPrivs syscall fails at startup. It is a hard startup failure: the security hardening option was explicitly requested, so the process refuses to continue without it. Typical causes are a seccomp filter or container runtime blocking the prctl syscall, or an unsupported kernel/platform.","triggerScenarios":"Thrown at util/config.go:912 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the wrapped syscall error — EPERM/EINVAL from prctl(PR_SET_NO_NEW_PRIVS) usually means the container/seccomp profile blocks it","Run the container with a seccomp profile that allows prctl (or the default Docker profile, which does)","Disable no_new_privs in the Semaphore config if the deployment environment legitimately cannot set it","Do not enable this option under gVisor/legacy runtimes that do not implement PR_SET_NO_NEW_PRIVS"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa","analyzedAt":"2026-09-07T11:00:33.293Z","contentChangedAt":"2026-09-07T11:00:33.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}