{"record":{"id":"d9344cd087d73b5d","repo":"pola-rs/polars","slug":"could-not-execute-mprotect-for-cpuid-check","errorCode":null,"errorMessage":"could not execute mprotect for CPUID check","messagePattern":"could not execute mprotect for CPUID check","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"py-polars/src/polars/_cpu_check.py","lineNumber":199,"sourceCode":"            # On some platforms PROT_WRITE + PROT_EXEC is forbidden, so we first\n            # only write and then mprotect into PROT_EXEC.\n            libc = _open_posix_libc()\n            mprotect = libc.mprotect\n            mprotect.argtypes = (ctypes.c_void_p, ctypes.c_size_t, ctypes.c_int)\n            mprotect.restype = ctypes.c_int\n\n            self.mmap = mmap.mmap(\n                -1,\n                size,\n                mmap.MAP_PRIVATE | mmap.MAP_ANONYMOUS,\n                mmap.PROT_READ | mmap.PROT_WRITE,\n            )\n            self.addr = ctypes.addressof(ctypes.c_void_p.from_buffer(self.mmap))\n            self.mmap.write(code)\n\n            if mprotect(self.addr, size, mmap.PROT_READ | mmap.PROT_EXEC) != 0:\n                msg = \"could not execute mprotect for CPUID check\"\n                raise RuntimeError(msg)\n\n        func_type = CFUNCTYPE(None, POINTER(CPUID_struct), c_uint32, c_uint32)\n        self.func_ptr = func_type(self.addr)\n\n    def __call__(self, eax: int, ecx: int = 0) -> CPUID_struct:\n        struct = CPUID_struct()\n        self.func_ptr(struct, eax, ecx)\n        return struct\n\n    def __del__(self) -> None:\n        if _IS_WINDOWS:\n            self.win.VirtualFree.restype = c_long\n            self.win.VirtualFree.argtypes = [c_void_p, c_size_t, c_ulong]\n            self.win.VirtualFree(self.addr, 0, _MEM_RELEASE)\n\n\ndef _read_cpu_flags() -> dict[str, bool]:\n    if not _SUPPORTS_CPUID:","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/pola-rs/polars/blob/df599052daf96e7a9cc30a3b0c6bd25d6947e3c0/py-polars/src/polars/_cpu_check.py#L181-L217","documentation":"On POSIX, polars writes a CPUID stub into an anonymous RW mmap and then calls mprotect to switch it to PROT_READ|PROT_EXEC before executing it at import time (write-then-protect to satisfy W^X-friendly platforms). This RuntimeError means mprotect returned non-zero: the kernel or a security policy refused to make the page executable, so the CPU feature probe cannot run.","triggerScenarios":"`import polars` on Linux/BSD under hardened kernels (PaX/grsec with MPROTECT), on OpenBSD when the filesystem backing the mapping is not mounted `wxallowed`, or inside sandboxes whose seccomp/AppArmor/gVisor profile rejects mprotect to PROT_EXEC.","commonSituations":"Hardened Gentoo/grsec hosts; OpenBSD default mounts; Docker with custom seccomp profiles denying exec-mprotect; endpoint-security software hooking mprotect; some minimal VM/emulation configurations.","solutions":["Set `POLARS_SKIP_CPU_CHECK=1` in the environment before importing polars — the CPUID probe is skipped entirely and no executable mapping is created","On OpenBSD, ensure the filesystem hosting site-packages (or /tmp) is mounted with the `wxallowed` option","Relax the seccomp/AppArmor/PaX policy so the Python process may mprotect a private anonymous mapping to PROT_EXEC","Run under a container/runtime profile that permits W->X transitions (default Docker seccomp profile does)"],"exampleFix":"# before\nimport polars as pl  # RuntimeError: could not execute mprotect for CPUID check\n\n# after\nimport os\nos.environ[\"POLARS_SKIP_CPU_CHECK\"] = \"1\"\nimport polars as pl","handlingStrategy":"fallback","validationCode":"import os, sys\n\nif sys.platform != \"win32\" and os.environ.get(\"POLARS_SKIP_CPU_CHECK\") is None:\n    # hardened environments (PaX/OpenBSD wxallowed/seccomp W^X) can be detected cheaply:\n    # if you know you run under one of these, skip the probe before importing polars\n    hardened_markers = [\"/proc/sys/kernel/grsecurity\", \"wxallowed-missing\", \"gvisor\"]\n    if any(os.path.exists(p) for p in hardened_markers[:1]):\n        os.environ[\"POLARS_SKIP_CPU_CHECK\"] = \"1\"","typeGuard":null,"tryCatchPattern":"import sys\ntry:\n    import polars as pl\nexcept RuntimeError as e:\n    if \"CPUID\" not in str(e):\n        raise\n    import os\n    os.environ[\"POLARS_SKIP_CPU_CHECK\"] = \"1\"\n    for m in [m for m in sys.modules if m.startswith(\"polars\")]:\n        del sys.modules[m]\n    import polars as pl  # noqa","preventionTips":["Set POLARS_SKIP_CPU_CHECK=1 by default in hardened hosts (grsec/PaX, gVisor, custom seccomp) where W^X is enforced","On OpenBSD, mount filesystems used by Python with wxallowed","Prefer the compat runtime package if CPU feature detection is unreliable in your environment","Bake the env var into container images/Dockerfiles for restricted runtimes so the first import succeeds"],"tags":["posix","mprotect","security-policy","containers","import-time","cpu-flags"],"backgroundTag":null,"analyzedSha":"df599052daf96e7a9cc30a3b0c6bd25d6947e3c0","analyzedAt":"2026-08-16T12:10:03.978Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}