{"record":{"id":"018c6c26f3fe1a97","repo":"elastic/elasticsearch","slug":"seccomp-unavailable-seccomp-seccomp-set-mode-filt","errorCode":null,"errorMessage":"seccomp unavailable: seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG) returned {}","messagePattern":"seccomp unavailable: seccomp\\(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG\\) returned (.+?)","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"warning","filePath":"libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java","lineNumber":198,"sourceCode":"        long ret = linuxLibc.syscall(arch.seccomp, bogusArg, 0, null);\n        if (ret != -1) {\n            throw new UnsupportedOperationException(\"seccomp unavailable: seccomp(BOGUS_OPERATION) returned \" + ret);\n        } else {\n            int errno = libc.errno();\n            switch (errno) {\n                case ENOSYS:\n                    break; // ok\n                case EINVAL:\n                    break; // ok\n                default:\n                    throw new UnsupportedOperationException(\"seccomp(BOGUS_OPERATION): \" + libc.strerror(errno));\n            }\n        }\n\n        // test seccomp(VALID, BOGUS)\n        ret = linuxLibc.syscall(arch.seccomp, SECCOMP_SET_MODE_FILTER, bogusArg, null);\n        if (ret != -1) {\n            throw new UnsupportedOperationException(\"seccomp unavailable: seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG) returned \" + ret);\n        } else {\n            int errno = libc.errno();\n            switch (errno) {\n                case ENOSYS:\n                    break; // ok\n                case EINVAL:\n                    break; // ok\n                default:\n                    throw new UnsupportedOperationException(\"seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG): \" + libc.strerror(errno));\n            }\n        }\n\n        // test prctl(BOGUS)\n        ret = linuxLibc.prctl(bogusArg, 0, 0, 0, 0);\n        if (ret != -1) {\n            throw new UnsupportedOperationException(\"seccomp unavailable: prctl(BOGUS_OPTION) returned \" + ret);\n        } else {\n            int errno = libc.errno();","sourceCodeStart":180,"sourceCodeEnd":216,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java#L180-L216","documentation":"A second probe calls seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG) with a valid operation but an invalid flag. It must return -1; if it returns success the implementation is broken and the sandbox refuses to install. This verifies that the seccomp filter-mode operation properly rejects bad flags before relying on it.","triggerScenarios":"tryInstallExecSandbox() probes seccomp(SECCOMP_SET_MODE_FILTER, 0xf7a46a5c, null) and the kernel returns a non-(-1) value, indicating it accepted a bogus flag.","commonSituations":"Same class of rare environments as the BOGUS_OPERATION probe: syscall-emulation runtimes, custom kernels, or sandboxes that stub seccomp calls to always succeed. Seen under some userspace syscall shims.","solutions":["Run on a mainstream Linux kernel without syscall emulation layers.","Disable the Elasticsearch exec sandbox in environments known to misreport seccomp behavior.","Verify the kernel is unmodified with a standalone seccomp capability test."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// No programmatic pre-check; this is a kernel ABI conformance probe for SECCOMP_SET_MODE_FILTER.\n// Run on a standard Linux kernel without syscall emulation.","typeGuard":null,"tryCatchPattern":"try {\n    nativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n    logger.warn(\"Exec sandbox unavailable (seccomp filter probe failed): {}\", e.getMessage());\n}","preventionTips":["Use a mainstream Linux kernel (3.17+ for SECCOMP_SET_MODE_FILTER).","Avoid syscall-emulation runtimes that misreport seccomp behavior.","Treat the exec sandbox as best-effort in emulated environments."],"tags":["seccomp","security","native","linux","bootstrap","probe"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}