{"record":{"id":"b0105d352171a347","repo":"elastic/elasticsearch","slug":"prctl-pr-set-seccomp","errorCode":null,"errorMessage":"prctl(PR_SET_SECCOMP): {}","messagePattern":"prctl\\(PR_SET_SECCOMP\\): (.+?)","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"warning","filePath":"libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java","lineNumber":275,"sourceCode":"                            + \" CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed\"\n                    );\n                } else {\n                    throw new UnsupportedOperationException(\"prctl(PR_GET_SECCOMP): \" + libc.strerror(errno));\n                }\n        }\n        // check for SECCOMP_MODE_FILTER\n        if (linuxLibc.prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0) != 0) {\n            int errno = libc.errno();\n            switch (errno) {\n                case EFAULT:\n                    break; // available\n                case EINVAL:\n                    throw new UnsupportedOperationException(\n                        \"seccomp unavailable: CONFIG_SECCOMP_FILTER not\"\n                            + \" compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed\"\n                    );\n                default:\n                    throw new UnsupportedOperationException(\"prctl(PR_SET_SECCOMP): \" + libc.strerror(errno));\n            }\n        }\n\n        // ok, now set PR_SET_NO_NEW_PRIVS, needed to be able to set a seccomp filter as ordinary user\n        if (linuxLibc.prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) {\n            throw new UnsupportedOperationException(\"prctl(PR_SET_NO_NEW_PRIVS): \" + libc.strerror(libc.errno()));\n        }\n\n        // check it worked\n        if (linuxLibc.prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0) != 1) {\n            throw new UnsupportedOperationException(\n                \"seccomp filter did not really succeed: prctl(PR_GET_NO_NEW_PRIVS): \" + libc.strerror(libc.errno())\n            );\n        }\n\n        // BPF installed to check arch, limit, then syscall.\n        // See https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt for details.\n        SockFilter insns[] = {","sourceCodeStart":257,"sourceCodeEnd":293,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java#L257-L293","documentation":"Thrown during Linux seccomp sandbox setup in tryInstallExecSandbox(). The code tests filter-mode availability with prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0). EFAULT is treated as 'filter mode available' (NULL arg expectedly faults); EINVAL means CONFIG_SECCOMP_FILTER is missing (error 663). This default branch catches any other errno, appending strerror. It means the kernel has the code path but something else blocked the probe.","triggerScenarios":"Calling tryInstallExecSandbox() where the SECCOMP_MODE_FILTER probe returns non-zero with errno that is neither EFAULT nor EINVAL.","commonSituations":"Security modules (SELinux, AppArmor) blocking the prctl; container runtimes with seccomp profiles filtering PR_SET_SECCOMP; kernel hardening patches that reject the probe.","solutions":["Read the strerror in the exception to identify the errno.","Check container and host security module policies for PR_SET_SECCOMP restrictions.","Verify kernel config has both CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER.","Run on an unmodified mainstream kernel to rule out security-module interference."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    nativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n    logger.warn(\"seccomp filter probe failed unexpectedly: {}\", e.getMessage());\n}","preventionTips":["Check container seccomp profiles for PR_SET_SECCOMP masking.","Verify SELinux/AppArmor policies allow the SECCOMP_MODE_FILTER probe.","Test the deployment environment with a known-good kernel before production rollout."],"tags":["linux","seccomp","security","native","kernel","bootstrap"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}