{"record":{"id":"dafadacf74fe0e9e","repo":"elastic/elasticsearch","slug":"prctl-pr-get-no-new-privs","errorCode":null,"errorMessage":"prctl(PR_GET_NO_NEW_PRIVS): {}","messagePattern":"prctl\\(PR_GET_NO_NEW_PRIVS\\): (.+?)","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"warning","filePath":"libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java","lineNumber":243,"sourceCode":"        }\n\n        // now just normal defensive checks\n\n        // check for GET_NO_NEW_PRIVS\n        switch (linuxLibc.prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)) {\n            case 0:\n                break; // not yet set\n            case 1:\n                break; // already set by caller\n            default:\n                int errno = libc.errno();\n                if (errno == EINVAL) {\n                    // friendly error, this will be the typical case for an old kernel\n                    throw new UnsupportedOperationException(\n                        \"seccomp unavailable: requires kernel 3.5+ with\" + \" CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in\"\n                    );\n                } else {\n                    throw new UnsupportedOperationException(\"prctl(PR_GET_NO_NEW_PRIVS): \" + libc.strerror(errno));\n                }\n        }\n        // check for SECCOMP\n        switch (linuxLibc.prctl(PR_GET_SECCOMP, 0, 0, 0, 0)) {\n            case 0:\n                break; // not yet set\n            case 2:\n                break; // already in filter mode by caller\n            default:\n                int errno = libc.errno();\n                if (errno == EINVAL) {\n                    throw new UnsupportedOperationException(\n                        \"seccomp unavailable: CONFIG_SECCOMP not compiled into kernel,\"\n                            + \" CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed\"\n                    );\n                } else {\n                    throw new UnsupportedOperationException(\"prctl(PR_GET_SECCOMP): \" + libc.strerror(errno));\n                }","sourceCodeStart":225,"sourceCodeEnd":261,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java#L225-L261","documentation":"Thrown during Linux seccomp sandbox setup in tryInstallExecSandbox(). The method probes prctl(PR_GET_NO_NEW_PRIVS) to check whether the NO_NEW_PRIVS flag is readable. It expects 0 (not set) or 1 (already set); any other return value enters the default branch. If errno is EINVAL the code throws a friendly 'old kernel' message (see error 661's sibling). This else-branch fires only for a non-EINVAL errno, appending libc.strerror(errno) to tell you exactly what the kernel rejected.","triggerScenarios":"Calling NativeAccess.instance().tryInstallExecSandbox() on Linux where prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0) returns a value other than 0 or 1, and libc.errno() is not EINVAL. Typical errno values seen: EPERM, ENOSYS, or EACCES from a security module intercepting the prctl call.","commonSituations":"Container runtimes (Docker, containerd) with a custom seccomp profile that masks PR_GET_NO_NEW_PRIVS; grsecurity/PaX-patched kernels; Linux compatibility layers on BSD hosts; hypervisors that intercept prctl syscalls. Most mainstream kernels return 0 or 1 here, so hitting this branch indicates an unusual environment.","solutions":["Inspect the strerror value embedded in the message to identify the specific errno (e.g. EPERM, ENOSYS).","If running in a container, check the runtime's seccomp profile allows prctl with PR_GET_NO_NEW_PRIVS/PR_SET_NO_NEW_PRIVS.","Verify kernel config: run zcat /proc/config.gz | grep -E 'CONFIG_SECCOMP' and ensure both CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are set to y.","Run on a mainstream distribution kernel >= 3.5 where this probe is known to succeed.","If the exec sandbox is not required for your deployment, the UnsupportedOperationException is informational — ES bootstrap logic decides whether to fail or continue based on production-mode settings."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// tryInstallExecSandbox() probes kernel capabilities at runtime.\n// There is no pre-check API; the method itself IS the capability test.\n// Catch UnsupportedOperationException and degrade gracefully.\ntry {\n    nativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n    logger.warn(\"exec sandbox unavailable on this platform, continuing without it: {}\", e.getMessage());\n    // ES continues; exec filtering (fork/execve blocking) is a hardening measure, not functional.\n}","preventionTips":["Run ES on mainstream Linux distribution kernels >= 3.5 with CONFIG_SECCOMP=y and CONFIG_SECCOMP_FILTER=y.","If using containers, ensure the runtime's seccomp profile allows prctl with PR_GET_NO_NEW_PRIVS.","Check zcat /proc/config.gz | grep SECCOMP during environment provisioning.","Monitor ES startup logs for sandbox-unavailable warnings to catch environment regressions early."],"tags":["linux","seccomp","security","native","kernel","bootstrap"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}