{"record":{"id":"8202459ac1709848","repo":"crowdsecurity/crowdsec","slug":"failed-to-create-wasm-runtime-in-compiler-mode-v","errorCode":null,"errorMessage":"failed to create wasm runtime in compiler mode: %v (the kernel likely denied an executable memory mapping: check W^X hardening, seccomp or SELinux policy)","messagePattern":"failed to create wasm runtime in compiler mode: (.+?) \\(the kernel likely denied an executable memory mapping: check W\\^X hardening, seccomp or SELinux policy\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/appsec/challenge/challenge.go","lineNumber":373,"sourceCode":"\tdefault:\n\t\treturn fmt.Errorf(\"GOARCH %s has no wasm compiler backend\", runtime.GOARCH)\n\t}\n}\n\nfunc newWazeroRuntime(ctx context.Context) (wazero.Runtime, error) {\n\tif err := compilerSupported(); err != nil {\n\t\treturn nil, fmt.Errorf(\"wasm compiler mode unavailable: %w\", err)\n\t}\n\n\tvar r wazero.Runtime\n\tvar err error\n\n\tfunc() {\n\t\t// wazero checks for executable memory, and panics if it cannot allocat it.\n\t\t// Catch the panic and return an error instead, so we can provide a more helpful message to the user.\n\t\tdefer func() {\n\t\t\tif rec := recover(); rec != nil {\n\t\t\t\terr = fmt.Errorf(\"failed to create wasm runtime in compiler mode: %v \"+\n\t\t\t\t\t\"(the kernel likely denied an executable memory mapping: check W^X hardening, seccomp or SELinux policy)\", rec)\n\t\t\t}\n\t\t}()\n\n\t\tr = wazero.NewRuntimeWithConfig(ctx, wazero.NewRuntimeConfigCompiler())\n\t}()\n\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn r, nil\n}\n\nfunc NewChallengeRuntime(ctx context.Context, opts ...Option) (*ChallengeRuntime, error) {\n\tresolvedOpts := runtimeOptions{}\n\tfor _, opt := range opts {\n\t\topt(&resolvedOpts)","sourceCodeStart":355,"sourceCodeEnd":391,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/challenge/challenge.go#L355-L391","documentation":"wazero panics when it cannot allocate executable memory for its compiler runtime; newWazeroRuntime recovers the panic and returns this error. It means the kernel refused an executable mapping (W^X policy, seccomp, SELinux, or hardened sandbox), so compiler-mode WASM cannot start.","triggerScenarios":"NewChallengeRuntime -> newWazeroRuntime -> wazero.NewRuntimeWithConfig(NewRuntimeConfigCompiler()) panics because mmap with PROT_EXEC is denied by seccomp, SELinux/AppArmor, gVisor, OpenBSD W^X, or container runtimes that disallow execmem.","commonSituations":"Docker with default seccomp in hardened setups, Kubernetes pods with restricted policies, SELinux enforcing on RHEL, gVisor/Kata sandboxes, shared hosting with noexec memory rules.","solutions":["Allow executable memory for the crowdsec process: adjust seccomp profile (allow mmap/mprotect with PROT_EXEC) or set the container to unconfined seccomp.","Adjust SELinux policy (e.g. set enforcement to permissive for testing, or add a module allowing execmem for crowdsec).","Run the container with a securityContext that permits execmem, or on hosts where W^X hardening can be relaxed for this process.","If policy cannot be changed, request/request upstream support for interpreter mode which does not need exec memory."],"exampleFix":"// docker run before/after\n// before\ndocker run crowdsec/crowdsec\n// after\ndocker run --security-opt seccomp=unconfined crowdsec/crowdsec # or a profile allowing execmem","handlingStrategy":"try-catch","validationCode":"// Pre-check execmem capability (Linux): attempt a PROT_EXEC mapping in your install script\n// Or check container seccomp/SELinux policy before deploying appsec","typeGuard":null,"tryCatchPattern":"err := initChallengeRuntime()\nif err != nil && strings.Contains(err.Error(), \"executable memory mapping\") {\n    // fall back: run without appsec challenge, or fix policy (seccomp=unconfined / SELinux permissive) and retry\n}","preventionTips":["Test the container image under your production seccomp/SELinux profile before rollout","Use a seccomp profile that permits execmem for crowdsec","Add the wrapped panic hint to your runbook (W^X, seccomp, SELinux)","Prefer dedicated VMs with default policies over hardened sandboxes for crowdsec"],"tags":["go","wasm","wazero","seccomp","selinux","containers"],"backgroundTag":"permission-denied","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}