{"record":{"id":"890d64e1b866fcb8","repo":"elastic/elasticsearch","slug":"seccomp-unavailable-seccomp-bogus-operation-retu","errorCode":null,"errorMessage":"seccomp unavailable: seccomp(BOGUS_OPERATION) returned {}","messagePattern":"seccomp unavailable: seccomp\\(BOGUS_OPERATION\\) returned (.+?)","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"warning","filePath":"libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java","lineNumber":182,"sourceCode":"     */\n    @Override\n    public void tryInstallExecSandbox() {\n        // first be defensive: we can give nice errors this way, at the very least.\n        // also, some of these security features get backported to old versions, checking kernel version here is a big no-no!\n        String archId = System.getProperty(\"os.arch\");\n        final Arch arch = ARCHITECTURES.get(archId);\n        if (arch == null) {\n            throw new UnsupportedOperationException(\"seccomp unavailable: '\" + archId + \"' architecture unsupported\");\n        }\n\n        // try to check system calls really are who they claim\n        // you never know (e.g. https://chromium.googlesource.com/chromium/src.git/+/master/sandbox/linux/seccomp-bpf/sandbox_bpf.cc#57)\n        final int bogusArg = 0xf7a46a5c;\n\n        // test seccomp(BOGUS)\n        long ret = linuxLibc.syscall(arch.seccomp, bogusArg, 0, null);\n        if (ret != -1) {\n            throw new UnsupportedOperationException(\"seccomp unavailable: seccomp(BOGUS_OPERATION) returned \" + ret);\n        } else {\n            int errno = libc.errno();\n            switch (errno) {\n                case ENOSYS:\n                    break; // ok\n                case EINVAL:\n                    break; // ok\n                default:\n                    throw new UnsupportedOperationException(\"seccomp(BOGUS_OPERATION): \" + libc.strerror(errno));\n            }\n        }\n\n        // test seccomp(VALID, BOGUS)\n        ret = linuxLibc.syscall(arch.seccomp, SECCOMP_SET_MODE_FILTER, bogusArg, null);\n        if (ret != -1) {\n            throw new UnsupportedOperationException(\"seccomp unavailable: seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG) returned \" + ret);\n        } else {\n            int errno = libc.errno();","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java#L164-L200","documentation":"As a sanity probe, tryInstallExecSandbox calls seccomp(BOGUS_OPERATION) expecting it to fail with -1. If the syscall instead returns a non-negative value, the kernel/libc is behaving incorrectly for a bogus operation code, so the sandbox code refuses to proceed. This guards against a seccomp implementation that does not reject unknown operations.","triggerScenarios":"Calling tryInstallExecSandbox() on a system where the seccomp(2) syscall accepts an invalid operation (0xf7a46a5c) and returns success instead of -1. This is a defensive probe failure indicating a broken or non-conformant seccomp implementation.","commonSituations":"Extremely rare. Could occur under compatibility/translation layers (e.g. syscall emulation in some container runtimes, gVisor, qemu user-mode) that mishandle unknown seccomp operations. Custom or patched kernels that alter seccomp semantics.","solutions":["Run on a mainstream Linux kernel (3.17+) with a standard libc, not under a syscall-emulation layer.","If running under gVisor/qemu-user or a custom seccomp shim, disable the exec sandbox for that environment.","Report the environment details; this indicates the seccomp surface is not behaving per the Linux ABI."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// No programmatic pre-check; this is a kernel ABI conformance probe.\n// Best validation is to run on a standard Linux kernel without syscall emulation.","typeGuard":null,"tryCatchPattern":"try {\n    nativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n    logger.warn(\"Exec sandbox unavailable (seccomp probe failed): {}\", e.getMessage());\n    // continue without sandbox\n}","preventionTips":["Run on a mainstream Linux kernel, not under gVisor/qemu-user/syscall shims.","Treat the exec sandbox as optional; Elasticsearch starts without it.","If the sandbox is mandatory for your policy, validate the host with a standalone seccomp test before deploying."],"tags":["seccomp","security","native","linux","bootstrap","probe"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}