{"record":{"id":"47ae4f0631af8781","repo":"elastic/elasticsearch","slug":"prctl-pr-get-seccomp","errorCode":null,"errorMessage":"prctl(PR_GET_SECCOMP): {}","messagePattern":"prctl\\(PR_GET_SECCOMP\\): (.+?)","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"warning","filePath":"libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java","lineNumber":260,"sourceCode":"                } else {\n                    throw new UnsupportedOperationException(\"prctl(PR_GET_NO_NEW_PRIVS): \" + libc.strerror(errno));\n                }\n        }\n        // check for SECCOMP\n        switch (linuxLibc.prctl(PR_GET_SECCOMP, 0, 0, 0, 0)) {\n            case 0:\n                break; // not yet set\n            case 2:\n                break; // already in filter mode by caller\n            default:\n                int errno = libc.errno();\n                if (errno == EINVAL) {\n                    throw new UnsupportedOperationException(\n                        \"seccomp unavailable: CONFIG_SECCOMP not compiled into kernel,\"\n                            + \" CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed\"\n                    );\n                } else {\n                    throw new UnsupportedOperationException(\"prctl(PR_GET_SECCOMP): \" + libc.strerror(errno));\n                }\n        }\n        // check for SECCOMP_MODE_FILTER\n        if (linuxLibc.prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0) != 0) {\n            int errno = libc.errno();\n            switch (errno) {\n                case EFAULT:\n                    break; // available\n                case EINVAL:\n                    throw new UnsupportedOperationException(\n                        \"seccomp unavailable: CONFIG_SECCOMP_FILTER not\"\n                            + \" compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed\"\n                    );\n                default:\n                    throw new UnsupportedOperationException(\"prctl(PR_SET_SECCOMP): \" + libc.strerror(errno));\n            }\n        }\n","sourceCodeStart":242,"sourceCodeEnd":278,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java#L242-L278","documentation":"Thrown during Linux seccomp sandbox setup in tryInstallExecSandbox(). The code probes prctl(PR_GET_SECCOMP) to check seccomp mode. It expects 0 (disabled) or 2 (filter mode). A return value in the default branch with errno != EINVAL triggers this generic error with libc.strerror(errno). Unlike error 661 (EINVAL → CONFIG_SECCOMP missing), this fires for any other unexpected errno, meaning the kernel has some seccomp code but the probe returned an abnormal error.","triggerScenarios":"Calling tryInstallExecSandbox() where prctl(PR_GET_SECCOMP) returns a value other than 0 or 2, and libc.errno() is not EINVAL. The strerror in the message identifies the specific failure.","commonSituations":"Container seccomp profiles that partially mask PR_GET_SECCOMP; kernel security modules (SELinux, AppArmor) denying the read; rare kernel bugs in backported seccomp patches.","solutions":["Read the strerror value in the exception message to pinpoint the errno.","Check container runtime seccomp/AppArmor/SELinux policies for PR_GET_SECCOMP restrictions.","Verify kernel seccomp support with zcat /proc/config.gz | grep SECCOMP.","Run on a mainstream kernel >= 3.5 without restrictive security modules interfering with prctl."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    nativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n    logger.warn(\"seccomp probe failed unexpectedly: {}\", e.getMessage());\n}","preventionTips":["Check container security policies for PR_GET_SECCOMP restrictions.","Verify no AppArmor/SELinux module is blocking prctl probes.","Run on unmodified mainstream kernels in production."],"tags":["linux","seccomp","security","native","kernel","bootstrap"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}