elastic/elasticsearch · warning · UnsupportedOperationException

prctl(PR_GET_NO_NEW_PRIVS)

Error message

prctl(PR_GET_NO_NEW_PRIVS): {}

What it means

Thrown during Linux seccomp sandbox setup in tryInstallExecSandbox(). The method probes prctl(PR_GET_NO_NEW_PRIVS) to check whether the NO_NEW_PRIVS flag is readable. It expects 0 (not set) or 1 (already set); any other return value enters the default branch. If errno is EINVAL the code throws a friendly 'old kernel' message (see error 661's sibling). This else-branch fires only for a non-EINVAL errno, appending libc.strerror(errno) to tell you exactly what the kernel rejected.

Solutions

  1. Inspect the strerror value embedded in the message to identify the specific errno (e.g. EPERM, ENOSYS).
  2. If running in a container, check the runtime's seccomp profile allows prctl with PR_GET_NO_NEW_PRIVS/PR_SET_NO_NEW_PRIVS.
  3. Verify kernel config: run zcat /proc/config.gz | grep -E 'CONFIG_SECCOMP' and ensure both CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are set to y.
  4. Run on a mainstream distribution kernel >= 3.5 where this probe is known to succeed.
  5. If the exec sandbox is not required for your deployment, the UnsupportedOperationException is informational — ES bootstrap logic decides whether to fail or continue based on production-mode settings.
Defensive patterns

Strategy: try-catch

Try / catch

// tryInstallExecSandbox() probes kernel capabilities at runtime.
// There is no pre-check API; the method itself IS the capability test.
// Catch UnsupportedOperationException and degrade gracefully.
try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("exec sandbox unavailable on this platform, continuing without it: {}", e.getMessage());
    // ES continues; exec filtering (fork/execve blocking) is a hardening measure, not functional.
}

Prevention

When it happens

Trigger: Calling NativeAccess.instance().tryInstallExecSandbox() on Linux where prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0) returns a value other than 0 or 1, and libc.errno() is not EINVAL. Typical errno values seen: EPERM, ENOSYS, or EACCES from a security module intercepting the prctl call.

Common situations: Container runtimes (Docker, containerd) with a custom seccomp profile that masks PR_GET_NO_NEW_PRIVS; grsecurity/PaX-patched kernels; Linux compatibility layers on BSD hosts; hypervisors that intercept prctl syscalls. Most mainstream kernels return 0 or 1 here, so hitting this branch indicates an unusual environment.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/dafadacf74fe0e9e. Report an issue: GitHub.

Appendix: source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:243

        }

        // now just normal defensive checks

        // check for GET_NO_NEW_PRIVS
        switch (linuxLibc.prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)) {
            case 0:
                break; // not yet set
            case 1:
                break; // already set by caller
            default:
                int errno = libc.errno();
                if (errno == EINVAL) {
                    // friendly error, this will be the typical case for an old kernel
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: requires kernel 3.5+ with" + " CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in"
                    );
                } else {
                    throw new UnsupportedOperationException("prctl(PR_GET_NO_NEW_PRIVS): " + libc.strerror(errno));
                }
        }
        // check for SECCOMP
        switch (linuxLibc.prctl(PR_GET_SECCOMP, 0, 0, 0, 0)) {
            case 0:
                break; // not yet set
            case 2:
                break; // already in filter mode by caller
            default:
                int errno = libc.errno();
                if (errno == EINVAL) {
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: CONFIG_SECCOMP not compiled into kernel,"
                            + " CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed"
                    );
                } else {
                    throw new UnsupportedOperationException("prctl(PR_GET_SECCOMP): " + libc.strerror(errno));
                }

View on GitHub (pinned to db6a809a66)