{"record":{"id":"7374f671a7513ed8","repo":"elastic/elasticsearch","slug":"seccomp-unavailable-config-seccomp-filter-not-com","errorCode":null,"errorMessage":"seccomp unavailable: CONFIG_SECCOMP_FILTER not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed","messagePattern":"seccomp unavailable: CONFIG_SECCOMP_FILTER not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"warning","filePath":"libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java","lineNumber":270,"sourceCode":"            default:\n                int errno = libc.errno();\n                if (errno == EINVAL) {\n                    throw new UnsupportedOperationException(\n                        \"seccomp unavailable: CONFIG_SECCOMP not compiled into kernel,\"\n                            + \" CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed\"\n                    );\n                } else {\n                    throw new UnsupportedOperationException(\"prctl(PR_GET_SECCOMP): \" + libc.strerror(errno));\n                }\n        }\n        // check for SECCOMP_MODE_FILTER\n        if (linuxLibc.prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0) != 0) {\n            int errno = libc.errno();\n            switch (errno) {\n                case EFAULT:\n                    break; // available\n                case EINVAL:\n                    throw new UnsupportedOperationException(\n                        \"seccomp unavailable: CONFIG_SECCOMP_FILTER not\"\n                            + \" compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed\"\n                    );\n                default:\n                    throw new UnsupportedOperationException(\"prctl(PR_SET_SECCOMP): \" + libc.strerror(errno));\n            }\n        }\n\n        // ok, now set PR_SET_NO_NEW_PRIVS, needed to be able to set a seccomp filter as ordinary user\n        if (linuxLibc.prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) {\n            throw new UnsupportedOperationException(\"prctl(PR_SET_NO_NEW_PRIVS): \" + libc.strerror(libc.errno()));\n        }\n\n        // check it worked\n        if (linuxLibc.prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0) != 1) {\n            throw new UnsupportedOperationException(\n                \"seccomp filter did not really succeed: prctl(PR_GET_NO_NEW_PRIVS): \" + libc.strerror(libc.errno())\n            );","sourceCodeStart":252,"sourceCodeEnd":288,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java#L252-L288","documentation":"Thrown during Linux seccomp sandbox setup in tryInstallExecSandbox(). After confirming CONFIG_SECCOMP exists (PR_GET_SECCOMP probe passed), the code tests whether filter mode is available by calling prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0) with a NULL argument. If errno is EINVAL, the kernel has CONFIG_SECCOMP but NOT CONFIG_SECCOMP_FILTER — strict mode exists but BPF filter mode does not. The message explicitly names the missing config.","triggerScenarios":"Calling tryInstallExecSandbox() on a kernel where prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0) returns non-zero with errno == EINVAL. This means CONFIG_SECCOMP=y but CONFIG_SECCOMP_FILTER is not set. Note: EFAULT is treated as 'available' because passing NULL is expected to fault, confirming the code path exists.","commonSituations":"Kernels between 3.5 that enabled CONFIG_SECCOMP for strict mode but omitted CONFIG_SECCOMP_FILTER; some older enterprise LTS kernels with partial backports; minimal cloud kernels.","solutions":["Recompile the kernel with CONFIG_SECCOMP_FILTER=y (in addition to CONFIG_SECCOMP=y).","Upgrade to a mainstream distribution kernel where CONFIG_SECCOMP_FILTER is default.","If the kernel cannot be changed, accept that the BPF-based exec sandbox is unavailable."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    nativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n    // Kernel has CONFIG_SECCOMP but not CONFIG_SECCOMP_FILTER.\n    logger.warn(\"seccomp filter mode unavailable: {}\", e.getMessage());\n}","preventionTips":["Ensure kernel is compiled with CONFIG_SECCOMP_FILTER=y (not just CONFIG_SECCOMP=y).","Use mainstream distribution kernels where both options are default-enabled.","Audit custom kernel configs for both options during provisioning."],"tags":["linux","seccomp","security","kernel","native","bootstrap"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}