{"record":{"id":"66d41f64a67c8a91","repo":"elastic/elasticsearch","slug":"seccomp-unavailable-config-seccomp-not-compiled-i","errorCode":null,"errorMessage":"seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed","messagePattern":"seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"warning","filePath":"libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java","lineNumber":255,"sourceCode":"                if (errno == EINVAL) {\n                    // friendly error, this will be the typical case for an old kernel\n                    throw new UnsupportedOperationException(\n                        \"seccomp unavailable: requires kernel 3.5+ with\" + \" CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in\"\n                    );\n                } else {\n                    throw new UnsupportedOperationException(\"prctl(PR_GET_NO_NEW_PRIVS): \" + libc.strerror(errno));\n                }\n        }\n        // check for SECCOMP\n        switch (linuxLibc.prctl(PR_GET_SECCOMP, 0, 0, 0, 0)) {\n            case 0:\n                break; // not yet set\n            case 2:\n                break; // already in filter mode by caller\n            default:\n                int errno = libc.errno();\n                if (errno == EINVAL) {\n                    throw new UnsupportedOperationException(\n                        \"seccomp unavailable: CONFIG_SECCOMP not compiled into kernel,\"\n                            + \" CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed\"\n                    );\n                } else {\n                    throw new UnsupportedOperationException(\"prctl(PR_GET_SECCOMP): \" + libc.strerror(errno));\n                }\n        }\n        // check for SECCOMP_MODE_FILTER\n        if (linuxLibc.prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0) != 0) {\n            int errno = libc.errno();\n            switch (errno) {\n                case EFAULT:\n                    break; // available\n                case EINVAL:\n                    throw new UnsupportedOperationException(\n                        \"seccomp unavailable: CONFIG_SECCOMP_FILTER not\"\n                            + \" compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed\"\n                    );","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java#L237-L273","documentation":"Thrown during Linux seccomp sandbox setup in tryInstallExecSandbox(). After the PR_GET_NO_NEW_PRIVS probe passes, the code calls prctl(PR_GET_SECCOMP) to check whether the kernel has the seccomp subsystem at all. If the return falls into the default branch and errno is EINVAL, the kernel was compiled without CONFIG_SECCOMP. This is the 'friendly error' for old or stripped-down kernels — the message explicitly names the missing config option.","triggerScenarios":"Calling tryInstallExecSandbox() on a Linux kernel where prctl(PR_GET_SECCOMP, 0, 0, 0, 0) returns a value other than 0 or 2 (the two valid modes), and libc.errno() == EINVAL. This means the kernel has no seccomp code compiled in at all.","commonSituations":"Embedded or minimal kernel builds (OpenWrt, custom Yocto kernels); very old kernels predating 3.5; cloud-provider custom kernels that strip CONFIG_SECCOMP for attack-surface reduction; CI environments using stripped VM kernels.","solutions":["Recompile the kernel with CONFIG_SECCOMP=y and CONFIG_SECCOMP_FILTER=y.","Upgrade to a mainstream distribution kernel (>= 3.5) where these options are default-enabled.","If you cannot change the kernel, accept that the exec sandbox is unavailable — ES will log the exception and bootstrap logic determines whether startup is blocked."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    nativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n    // Kernel lacks CONFIG_SECCOMP entirely.\n    logger.warn(\"seccomp unavailable (kernel compiled without CONFIG_SECCOMP): {}\", e.getMessage());\n}","preventionTips":["Provision servers with mainstream distribution kernels that default CONFIG_SECCOMP=y.","For custom/embedded kernels, always set CONFIG_SECCOMP=y and CONFIG_SECCOMP_FILTER=y.","Document the kernel config requirements in your deployment runbook."],"tags":["linux","seccomp","security","kernel","native","bootstrap"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}