{"record":{"id":"b10d6bab86326284","repo":"elastic/elasticsearch","slug":"seccomp-seccomp-set-mode-filter-bogus-flag","errorCode":null,"errorMessage":"seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG): {}","messagePattern":"seccomp\\(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG\\): (.+?)","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"warning","filePath":"libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java","lineNumber":207,"sourceCode":"                    break; // ok\n                default:\n                    throw new UnsupportedOperationException(\"seccomp(BOGUS_OPERATION): \" + libc.strerror(errno));\n            }\n        }\n\n        // test seccomp(VALID, BOGUS)\n        ret = linuxLibc.syscall(arch.seccomp, SECCOMP_SET_MODE_FILTER, bogusArg, null);\n        if (ret != -1) {\n            throw new UnsupportedOperationException(\"seccomp unavailable: seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG) returned \" + ret);\n        } else {\n            int errno = libc.errno();\n            switch (errno) {\n                case ENOSYS:\n                    break; // ok\n                case EINVAL:\n                    break; // ok\n                default:\n                    throw new UnsupportedOperationException(\"seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG): \" + libc.strerror(errno));\n            }\n        }\n\n        // test prctl(BOGUS)\n        ret = linuxLibc.prctl(bogusArg, 0, 0, 0, 0);\n        if (ret != -1) {\n            throw new UnsupportedOperationException(\"seccomp unavailable: prctl(BOGUS_OPTION) returned \" + ret);\n        } else {\n            int errno = libc.errno();\n            switch (errno) {\n                case ENOSYS:\n                    break; // ok\n                case EINVAL:\n                    break; // ok\n                default:\n                    throw new UnsupportedOperationException(\"prctl(BOGUS_OPTION): \" + libc.strerror(errno));\n            }\n        }","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java#L189-L225","documentation":"The seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG) probe returned -1 but with an errno other than ENOSYS/EINVAL. The raw strerror is included. This is the filter-mode variant of the generic bogus-errno probe and catches privilege or memory errors during the capability check.","triggerScenarios":"The SECCOMP_SET_MODE_FILTER probe in tryInstallExecSandbox() fails with an unexpected errno such as EPERM or EACCES, indicating the process lacks permission to use seccomp filters.","commonSituations":"Container runtimes that forbid SECCOMP_SET_MODE_FILTER via an outer seccomp profile. Running without CAP_SYS_ADMIN where required. Nested sandboxing restrictions.","solutions":["Inspect the strerror; if EPERM/EACCES, adjust the container or host seccomp profile to permit SECCOMP_SET_MODE_FILTER.","Run Elasticsearch with sufficient privileges or disable the inner exec sandbox where the outer policy is authoritative.","Move to an environment without nested seccomp restrictions."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// Cannot pre-check; this surfaces an unexpected errno on the SECCOMP_SET_MODE_FILTER probe.\n// Ensure the runtime permits seccomp filter installation.","typeGuard":null,"tryCatchPattern":"try {\n    nativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n    logger.warn(\"Exec sandbox unavailable: {}\", e.getMessage());\n}","preventionTips":["Permit SECCOMP_SET_MODE_FILTER in the container/outer seccomp profile.","Run Elasticsearch with privileges adequate for seccomp, or accept its absence.","Diagnose recurring EPERM/EACCES by inspecting the host/container security policy."],"tags":["seccomp","security","native","linux","bootstrap","errno"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}