{"record":{"id":"861cba525c505003","repo":"elastic/elasticsearch","slug":"prctl-bogus-option","errorCode":null,"errorMessage":"prctl(BOGUS_OPTION): {}","messagePattern":"prctl\\(BOGUS_OPTION\\): (.+?)","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"warning","filePath":"libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java","lineNumber":223,"sourceCode":"                    break; // ok\n                default:\n                    throw new UnsupportedOperationException(\"seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG): \" + libc.strerror(errno));\n            }\n        }\n\n        // test prctl(BOGUS)\n        ret = linuxLibc.prctl(bogusArg, 0, 0, 0, 0);\n        if (ret != -1) {\n            throw new UnsupportedOperationException(\"seccomp unavailable: prctl(BOGUS_OPTION) returned \" + ret);\n        } else {\n            int errno = libc.errno();\n            switch (errno) {\n                case ENOSYS:\n                    break; // ok\n                case EINVAL:\n                    break; // ok\n                default:\n                    throw new UnsupportedOperationException(\"prctl(BOGUS_OPTION): \" + libc.strerror(errno));\n            }\n        }\n\n        // now just normal defensive checks\n\n        // check for GET_NO_NEW_PRIVS\n        switch (linuxLibc.prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)) {\n            case 0:\n                break; // not yet set\n            case 1:\n                break; // already set by caller\n            default:\n                int errno = libc.errno();\n                if (errno == EINVAL) {\n                    // friendly error, this will be the typical case for an old kernel\n                    throw new UnsupportedOperationException(\n                        \"seccomp unavailable: requires kernel 3.5+ with\" + \" CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in\"\n                    );","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java#L205-L241","documentation":"The prctl(BOGUS_OPTION) probe returned -1 but with an errno that is neither ENOSYS nor EINVAL. The strerror is appended. This catches unexpected failures of the prctl capability probe itself, such as privilege denials.","triggerScenarios":"tryInstallExecSandbox()'s prctl(BOGUS) probe fails with an unexpected errno (e.g. EPERM) rather than the expected ENOSYS/EINVAL.","commonSituations":"Outer seccomp/LSM policies that block prctl outright. Containers with restricted prctl access. Kernel or libc corruption.","solutions":["Read the strerror; EPERM/EACCES suggests an outer policy blocks prctl - relax it or disable the inner sandbox.","Run on an unrestricted host to isolate whether the restriction is container-imposed.","If strerror indicates ENOSYS-style absence, upgrade to a kernel with prctl support."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// Cannot pre-check; this surfaces an unexpected errno on the prctl bogus-option probe.\n// Ensure the runtime permits prctl calls.","typeGuard":null,"tryCatchPattern":"try {\n    nativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n    logger.warn(\"Exec sandbox unavailable (prctl errno): {}\", e.getMessage());\n}","preventionTips":["Relax outer seccomp/LSM policies that deny prctl.","Run on an unrestricted host to determine if the container imposes the limit.","Accept sandbox absence if the restriction is intentional."],"tags":["seccomp","security","native","linux","bootstrap","prctl","errno"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T11:17:21.771Z"}