● Server & Claude Code
status=242/NUMA_POLICY is not a seccomp kill
On systemd 255.4, status=242/NUMA_POLICY was a NUMA policy, not a seccomp kill. I used ExecStart=/bin/true on 2026-10-21. systemd-analyze verify exited 0. systemd-analyze exit-status on this machine names 242 NUMA_POLICY and 228 SECCOMP. The man page here says 242 is Failed to set up unit's NUMA memory policy and 228 is Failed to apply system call filters. I did not produce status=228/SECCOMP. The units lived under /run and were removed. The remote-control unit that was already running stayed active. I did not start it. This machine has one NUMA node, node0.
bind and interleave need a node that is online
| What the unit had | verify | systemctl start | Result |
|---|---|---|---|
NUMAPolicy=bind, no NUMAMask=. Type=oneshot. | Exit 0. No output. | Exit 1. | Failed to set NUMA memory policy: Invalid argument, then status=242/NUMA_POLICY. Result=exit-code. ExecMainStatus=242. |
NUMAPolicy=interleave, no NUMAMask=. | Exit 0. | Exit 1. | The same status=242/NUMA_POLICY sentence. |
NUMAPolicy=bind and NUMAMask=99. | Exit 0. | Exit 1. | status=242/NUMA_POLICY. Node 99 is not online here. |
Type=simple and NUMAPolicy=bind with no mask. | Exit 0. | Exit 0. | The journal said Started, then status=242/NUMA_POLICY. About a second later the unit was failed and Result=exit-code. |
NUMAPolicy=bind with NUMAMask=0. Also NUMAMask=all. Also NUMAPolicy=interleave with NUMAMask=0. | Exit 0. | Exit 0. | Finished. Result=success. |
NUMAPolicy=preferred with no mask, and the same line with NUMAMask=0. Also local. Also default. | Exit 0. | Exit 0. | Finished. preferred with no mask is not 242. |
NUMAPolicy=notapolicy. | Exit 0. Invalid NUMA policy type, ignoring: notapolicy. | Exit 0. | Finished. The bad name is not 242. |
A syscall filter kill is status=31/SYS
These were not 242 and not 228. verify exited 0 for each of them. @system-service is not the line that failed.
| What the unit had | oneshot start | What the journal said |
|---|---|---|
SystemCallFilter=~write and ExecStart=/bin/echo hello. | Exit 1. | code=dumped, status=31/SYS, signal=SYS, Result=core-dump. |
The same filter, Type=simple. | The start command exited 0. | Started, then status=31/SYS. About a second later Result=core-dump. |
SystemCallFilter=~write and SystemCallErrorNumber=EPERM. Also SystemCallFilter=~write:EPERM. | Exit 1. | status=1/FAILURE. Result=exit-code. Not a core dump. |
SystemCallFilter=write and ExecStart=/bin/true. Also SystemCallFilter=exit and /bin/true, run as a transient unit. | Exit 1. | status=31/SYS. A known syscall name is not proof the program can run. |
SystemCallFilter=not_a_syscall_zz and /bin/true. | Exit 1. | verify said System call not_a_syscall_zz is not known, ignoring. The start was still status=31/SYS. Ignoring the name did not turn the filter off. |
SystemCallFilter=@not_a_group. | Exit 1. | verify said Unknown system call group, ignoring. The start was still status=31/SYS. |
SystemCallFilter=~write:99999. | Exit 0. | verify said Failed to parse syscall:errno, ignoring. The unit finished. That line was ignored. |
SystemCallFilter=~@known and /bin/true. | Exit 1. | status=31/SYS. |
SystemCallFilter=@system-service with /bin/true, with python3 -c 'print(1)', and with python3 calling /bin/true. Also that set plus ~@privileged, ~@resources, and SystemCallErrorNumber=EPERM on the python call. Also SystemCallFilter=@known. | Exit 0. | Finished. Result=success. |
MemoryDenyWriteExecute=yes with /bin/true and with python3 -c 'print(1)'. Also SystemCallArchitectures=x86 and arm64, each with @system-service and /bin/true. | Exit 0. | Finished. An unknown architecture name was ignored, and that unit finished too. |
SystemCallFilter=~execve with /bin/true was also status=31/SYS. The man page says execve is implicitly allow-listed. This run still dumped core.
What the local check flags
The browser paste and the local script flag systemd-numa-policy when NUMAPolicy=bind or NUMAPolicy=interleave and the unit has no NUMAMask=. The severity is high. The local script also flags that policy when every node in NUMAMask= is an integer that is not online on this machine. NUMAMask=all is not this finding. A range was not measured and is not this finding. preferred, local, default, and an unknown policy name are not this finding. The checker does not flag SystemCallFilter. @system-service started, and a filter of one known name killed /bin/true. The browser paste cannot see which nodes are online, so a numeric mask is only the local script.
A missing mount path is status=226/NAMESPACE. ProtectSystem=strict still exits 0 while a new file is Read-only file system: ProtectSystem=strict. The remote-control unit is the Agent Ops Kit ($19). The same unit is on the kit page. The remote-control note is where that unit is written out. For a second and third vendor CLI, the Multi-Vendor AI Council Ops Kit is $39.
Need a VPS to try this on? Everything here was tested on a DigitalOcean Ubuntu 24.04 droplet: get one on DigitalOcean. The DigitalOcean link pays the site owner account credit, not cash. Any other affiliate link may pay a commission. Your price is the same. Disclosure.