{"record":{"id":"6ef553e9b179e460","repo":"elastic/elasticsearch","slug":"seccomp-filter-did-not-really-succeed-prctl-pr-ge","errorCode":null,"errorMessage":"seccomp filter did not really succeed: prctl(PR_GET_NO_NEW_PRIVS): {}","messagePattern":"seccomp filter did not really succeed: prctl\\(PR_GET_NO_NEW_PRIVS\\): (.+?)","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"warning","filePath":"libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java","lineNumber":286,"sourceCode":"                    break; // available\n                case EINVAL:\n                    throw new UnsupportedOperationException(\n                        \"seccomp unavailable: CONFIG_SECCOMP_FILTER not\"\n                            + \" compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed\"\n                    );\n                default:\n                    throw new UnsupportedOperationException(\"prctl(PR_SET_SECCOMP): \" + libc.strerror(errno));\n            }\n        }\n\n        // ok, now set PR_SET_NO_NEW_PRIVS, needed to be able to set a seccomp filter as ordinary user\n        if (linuxLibc.prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) {\n            throw new UnsupportedOperationException(\"prctl(PR_SET_NO_NEW_PRIVS): \" + libc.strerror(libc.errno()));\n        }\n\n        // check it worked\n        if (linuxLibc.prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0) != 1) {\n            throw new UnsupportedOperationException(\n                \"seccomp filter did not really succeed: prctl(PR_GET_NO_NEW_PRIVS): \" + libc.strerror(libc.errno())\n            );\n        }\n\n        // BPF installed to check arch, limit, then syscall.\n        // See https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt for details.\n        SockFilter insns[] = {\n            /* 1  */ BPF_STMT(BPF_LD + BPF_W + BPF_ABS, SECCOMP_DATA_ARCH_OFFSET),             //\n            /* 2  */ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, arch.audit, 0, 7),                 // if (arch != audit) goto fail;\n            /* 3  */ BPF_STMT(BPF_LD + BPF_W + BPF_ABS, SECCOMP_DATA_NR_OFFSET),               //\n            /* 4  */ BPF_JUMP(BPF_JMP + BPF_JGT + BPF_K, arch.limit, 5, 0),                 // if (syscall > LIMIT) goto fail;\n            /* 5  */ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, arch.fork, 4, 0),                 // if (syscall == FORK) goto fail;\n            /* 6  */ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, arch.vfork, 3, 0),                 // if (syscall == VFORK) goto fail;\n            /* 7  */ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, arch.execve, 2, 0),                 // if (syscall == EXECVE) goto fail;\n            /* 8  */ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, arch.execveat, 1, 0),                 // if (syscall == EXECVEAT) goto fail;\n            /* 9  */ BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),                                // pass: return OK;\n            /* 10 */ BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ERRNO | (EACCES & SECCOMP_RET_DATA)),  // fail: return EACCES;\n        };","sourceCodeStart":268,"sourceCodeEnd":304,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java#L268-L304","documentation":"Thrown during Linux seccomp sandbox setup in tryInstallExecSandbox(). After prctl(PR_SET_NO_NEW_PRIVS, 1) returns 0 (success), the code verifies by reading back with prctl(PR_GET_NO_NEW_PRIVS) and expecting exactly 1. If the read-back returns anything other than 1, the set silently did not take effect and this consistency-check error fires with strerror from the GET call. This catches kernel or hypervisor bugs where the set appears to succeed but does not persist.","triggerScenarios":"Calling tryInstallExecSandbox() where prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) returned 0 (apparent success) but the subsequent prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0) returns a value != 1.","commonSituations":"Hypervisor or kernel bugs that silently swallow the NO_NEW_PRIVS set; niche virtualization environments (paravirtualized kernels) that intercept prctl; extremely rare kernel race conditions. This should essentially never happen on a healthy mainstream kernel.","solutions":["Read the strerror in the message for clues about the GET failure.","Check for known kernel bugs on your kernel version related to prctl/NO_NEW_PRIVS.","Upgrade the kernel or hypervisor.","If unresolvable, accept that the exec sandbox could not be installed."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    nativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n    // PR_SET_NO_NEW_PRIVS appeared to succeed but verification failed.\n    logger.warn(\"NO_NEW_PRIVS verification failed, possible kernel bug: {}\", e.getMessage());\n}","preventionTips":["Keep kernels updated — this indicates a kernel or hypervisor bug.","Avoid niche virtualization platforms that intercept prctl.","Monitor for this warning after kernel upgrades."],"tags":["linux","seccomp","security","native","kernel","bootstrap","consistency-check"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}