elastic/elasticsearch · warning · UnsupportedOperationException

prctl(PR_SET_NO_NEW_PRIVS): {}

Error message

prctl(PR_SET_NO_NEW_PRIVS): {}

What it means

Thrown during Linux seccomp sandbox setup in tryInstallExecSandbox(). After all probes pass, the code performs the real operation: prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) to set the NO_NEW_PRIVS flag, which is a prerequisite for installing a seccomp BPF filter as a non-root user. If the set returns non-zero, this error fires with strerror. Unlike the earlier probes (which test capability), this is the actual state-changing call.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:281

        // check for SECCOMP_MODE_FILTER
        if (linuxLibc.prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0) != 0) {
            int errno = libc.errno();
            switch (errno) {
                case EFAULT:
                    break; // available
                case EINVAL:
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: CONFIG_SECCOMP_FILTER not"
                            + " compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed"
                    );
                default:
                    throw new UnsupportedOperationException("prctl(PR_SET_SECCOMP): " + libc.strerror(errno));
            }
        }

        // ok, now set PR_SET_NO_NEW_PRIVS, needed to be able to set a seccomp filter as ordinary user
        if (linuxLibc.prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) {
            throw new UnsupportedOperationException("prctl(PR_SET_NO_NEW_PRIVS): " + libc.strerror(libc.errno()));
        }

        // check it worked
        if (linuxLibc.prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0) != 1) {
            throw new UnsupportedOperationException(
                "seccomp filter did not really succeed: prctl(PR_GET_NO_NEW_PRIVS): " + libc.strerror(libc.errno())
            );
        }

        // BPF installed to check arch, limit, then syscall.
        // See https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt for details.
        SockFilter insns[] = {
            /* 1  */ BPF_STMT(BPF_LD + BPF_W + BPF_ABS, SECCOMP_DATA_ARCH_OFFSET),             //
            /* 2  */ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, arch.audit, 0, 7),                 // if (arch != audit) goto fail;
            /* 3  */ BPF_STMT(BPF_LD + BPF_W + BPF_ABS, SECCOMP_DATA_NR_OFFSET),               //
            /* 4  */ BPF_JUMP(BPF_JMP + BPF_JGT + BPF_K, arch.limit, 5, 0),                 // if (syscall > LIMIT) goto fail;
            /* 5  */ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, arch.fork, 4, 0),                 // if (syscall == FORK) goto fail;
            /* 6  */ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, arch.vfork, 3, 0),                 // if (syscall == VFORK) goto fail;

View on GitHub (pinned to db6a809a66)

Solutions

1. Read the strerror to identify the errno (commonly EPERM or EACCES).
2. If running under systemd, check NoNewPrivileges in the unit file — if already set, the prctl should be a no-op; if conflicting, reconcile the setting.
3. If in a container, verify the seccomp/AppArmor profile allows PR_SET_NO_NEW_PRIVS or run with --security-opt no-new-privileges:false if appropriate.
4. Ensure the process has not already dropped CAP_SYS_ADMIN or equivalent capabilities needed for the call.
5. If the sandbox is not required, accept the failure — ES continues without exec filtering.

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    // The actual PR_SET_NO_NEW_PRIVS operation was blocked.
    logger.warn("could not set NO_NEW_PRIVS, exec sandbox unavailable: {}", e.getMessage());
}

When it happens

Trigger: Calling tryInstallExecSandbox() where prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) returns non-zero. The probes at lines 229-244 confirmed the kernel supports the primitive, but actually setting it fails.

Common situations: Container runtimes (especially Docker with custom --security-opt profiles) that block setting NO_NEW_PRIVS; SELinux/AppArmor policies denying the transition; processes that have already dropped capabilities needed for the prctl; some systemd unit configurations with NoNewPrivileges=false conflicting with the call.

Related errors

• seccomp unavailable: prctl(BOGUS_OPTION) returned {}
• prctl(BOGUS_OPTION): {}
• seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOM
• prctl(PR_GET_NO_NEW_PRIVS): {}
• seccomp unavailable: CONFIG_SECCOMP not compiled into kernel

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/cfb95c8640f13780. Report an issue: GitHub.