elastic/elasticsearch · warning · UnsupportedOperationException

seccomp filter did not really succeed: prctl(PR_GET_NO_NEW_P

Error message

seccomp filter did not really succeed: prctl(PR_GET_NO_NEW_PRIVS): {}

What it means

Thrown during Linux seccomp sandbox setup in tryInstallExecSandbox(). After prctl(PR_SET_NO_NEW_PRIVS, 1) returns 0 (success), the code verifies by reading back with prctl(PR_GET_NO_NEW_PRIVS) and expecting exactly 1. If the read-back returns anything other than 1, the set silently did not take effect and this consistency-check error fires with strerror from the GET call. This catches kernel or hypervisor bugs where the set appears to succeed but does not persist.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:286

                    break; // available
                case EINVAL:
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: CONFIG_SECCOMP_FILTER not"
                            + " compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed"
                    );
                default:
                    throw new UnsupportedOperationException("prctl(PR_SET_SECCOMP): " + libc.strerror(errno));
            }
        }

        // ok, now set PR_SET_NO_NEW_PRIVS, needed to be able to set a seccomp filter as ordinary user
        if (linuxLibc.prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) {
            throw new UnsupportedOperationException("prctl(PR_SET_NO_NEW_PRIVS): " + libc.strerror(libc.errno()));
        }

        // check it worked
        if (linuxLibc.prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0) != 1) {
            throw new UnsupportedOperationException(
                "seccomp filter did not really succeed: prctl(PR_GET_NO_NEW_PRIVS): " + libc.strerror(libc.errno())
            );
        }

        // BPF installed to check arch, limit, then syscall.
        // See https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt for details.
        SockFilter insns[] = {
            /* 1  */ BPF_STMT(BPF_LD + BPF_W + BPF_ABS, SECCOMP_DATA_ARCH_OFFSET),             //
            /* 2  */ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, arch.audit, 0, 7),                 // if (arch != audit) goto fail;
            /* 3  */ BPF_STMT(BPF_LD + BPF_W + BPF_ABS, SECCOMP_DATA_NR_OFFSET),               //
            /* 4  */ BPF_JUMP(BPF_JMP + BPF_JGT + BPF_K, arch.limit, 5, 0),                 // if (syscall > LIMIT) goto fail;
            /* 5  */ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, arch.fork, 4, 0),                 // if (syscall == FORK) goto fail;
            /* 6  */ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, arch.vfork, 3, 0),                 // if (syscall == VFORK) goto fail;
            /* 7  */ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, arch.execve, 2, 0),                 // if (syscall == EXECVE) goto fail;
            /* 8  */ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, arch.execveat, 1, 0),                 // if (syscall == EXECVEAT) goto fail;
            /* 9  */ BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),                                // pass: return OK;
            /* 10 */ BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ERRNO | (EACCES & SECCOMP_RET_DATA)),  // fail: return EACCES;
        };

View on GitHub (pinned to db6a809a66)

Solutions

Read the strerror in the message for clues about the GET failure.
Check for known kernel bugs on your kernel version related to prctl/NO_NEW_PRIVS.
Upgrade the kernel or hypervisor.
If unresolvable, accept that the exec sandbox could not be installed.

Defensive patterns

Strategy: try-catch

Try / catch

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    // PR_SET_NO_NEW_PRIVS appeared to succeed but verification failed.
    logger.warn("NO_NEW_PRIVS verification failed, possible kernel bug: {}", e.getMessage());
}

Prevention

Keep kernels updated — this indicates a kernel or hypervisor bug.
Avoid niche virtualization platforms that intercept prctl.
Monitor for this warning after kernel upgrades.

When it happens

Trigger: Calling tryInstallExecSandbox() where prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) returned 0 (apparent success) but the subsequent prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0) returns a value != 1.

Common situations: Hypervisor or kernel bugs that silently swallow the NO_NEW_PRIVS set; niche virtualization environments (paravirtualized kernels) that intercept prctl; extremely rare kernel race conditions. This should essentially never happen on a healthy mainstream kernel.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/6ef553e9b179e460. Report an issue: GitHub.