What causes "prctl(PR_GET_NO_NEW_PRIVS): {}" in elastic/elasticsearch?

Inspect the strerror value embedded in the message to identify the specific errno (e.g. EPERM, ENOSYS).

elastic/elasticsearch · warning · UnsupportedOperationException

prctl(PR_GET_NO_NEW_PRIVS): {}

Error message

prctl(PR_GET_NO_NEW_PRIVS): {}

What it means

Thrown during Linux seccomp sandbox setup in tryInstallExecSandbox(). The method probes prctl(PR_GET_NO_NEW_PRIVS) to check whether the NO_NEW_PRIVS flag is readable. It expects 0 (not set) or 1 (already set); any other return value enters the default branch. If errno is EINVAL the code throws a friendly 'old kernel' message (see error 661's sibling). This else-branch fires only for a non-EINVAL errno, appending libc.strerror(errno) to tell you exactly what the kernel rejected.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:243

        }

        // now just normal defensive checks

        // check for GET_NO_NEW_PRIVS
        switch (linuxLibc.prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)) {
            case 0:
                break; // not yet set
            case 1:
                break; // already set by caller
            default:
                int errno = libc.errno();
                if (errno == EINVAL) {
                    // friendly error, this will be the typical case for an old kernel
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: requires kernel 3.5+ with" + " CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in"
                    );
                } else {
                    throw new UnsupportedOperationException("prctl(PR_GET_NO_NEW_PRIVS): " + libc.strerror(errno));
                }
        }
        // check for SECCOMP
        switch (linuxLibc.prctl(PR_GET_SECCOMP, 0, 0, 0, 0)) {
            case 0:
                break; // not yet set
            case 2:
                break; // already in filter mode by caller
            default:
                int errno = libc.errno();
                if (errno == EINVAL) {
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: CONFIG_SECCOMP not compiled into kernel,"
                            + " CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed"
                    );
                } else {
                    throw new UnsupportedOperationException("prctl(PR_GET_SECCOMP): " + libc.strerror(errno));
                }

View on GitHub (pinned to db6a809a66)

Solutions

Inspect the strerror value embedded in the message to identify the specific errno (e.g. EPERM, ENOSYS).
If running in a container, check the runtime's seccomp profile allows prctl with PR_GET_NO_NEW_PRIVS/PR_SET_NO_NEW_PRIVS.
Verify kernel config: run zcat /proc/config.gz | grep -E 'CONFIG_SECCOMP' and ensure both CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are set to y.
Run on a mainstream distribution kernel >= 3.5 where this probe is known to succeed.
If the exec sandbox is not required for your deployment, the UnsupportedOperationException is informational — ES bootstrap logic decides whether to fail or continue based on production-mode settings.

Defensive patterns

Strategy: try-catch

Try / catch

// tryInstallExecSandbox() probes kernel capabilities at runtime.
// There is no pre-check API; the method itself IS the capability test.
// Catch UnsupportedOperationException and degrade gracefully.
try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("exec sandbox unavailable on this platform, continuing without it: {}", e.getMessage());
    // ES continues; exec filtering (fork/execve blocking) is a hardening measure, not functional.
}

Prevention

Run ES on mainstream Linux distribution kernels >= 3.5 with CONFIG_SECCOMP=y and CONFIG_SECCOMP_FILTER=y.
If using containers, ensure the runtime's seccomp profile allows prctl with PR_GET_NO_NEW_PRIVS.
Check zcat /proc/config.gz | grep SECCOMP during environment provisioning.
Monitor ES startup logs for sandbox-unavailable warnings to catch environment regressions early.

When it happens

Trigger: Calling NativeAccess.instance().tryInstallExecSandbox() on Linux where prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0) returns a value other than 0 or 1, and libc.errno() is not EINVAL. Typical errno values seen: EPERM, ENOSYS, or EACCES from a security module intercepting the prctl call.

Common situations: Container runtimes (Docker, containerd) with a custom seccomp profile that masks PR_GET_NO_NEW_PRIVS; grsecurity/PaX-patched kernels; Linux compatibility layers on BSD hosts; hypervisors that intercept prctl syscalls. Most mainstream kernels return 0 or 1 here, so hitting this branch indicates an unusual environment.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/dafadacf74fe0e9e. Report an issue: GitHub.