{"record":{"id":"bd93e509583acedb","repo":"elastic/elasticsearch","slug":"seccomp-unavailable-prctl-bogus-option-returned","errorCode":null,"errorMessage":"seccomp unavailable: prctl(BOGUS_OPTION) returned {}","messagePattern":"seccomp unavailable: prctl\\(BOGUS_OPTION\\) returned (.+?)","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"warning","filePath":"libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java","lineNumber":214,"sourceCode":"        ret = linuxLibc.syscall(arch.seccomp, SECCOMP_SET_MODE_FILTER, bogusArg, null);\n        if (ret != -1) {\n            throw new UnsupportedOperationException(\"seccomp unavailable: seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG) returned \" + ret);\n        } else {\n            int errno = libc.errno();\n            switch (errno) {\n                case ENOSYS:\n                    break; // ok\n                case EINVAL:\n                    break; // ok\n                default:\n                    throw new UnsupportedOperationException(\"seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG): \" + libc.strerror(errno));\n            }\n        }\n\n        // test prctl(BOGUS)\n        ret = linuxLibc.prctl(bogusArg, 0, 0, 0, 0);\n        if (ret != -1) {\n            throw new UnsupportedOperationException(\"seccomp unavailable: prctl(BOGUS_OPTION) returned \" + ret);\n        } else {\n            int errno = libc.errno();\n            switch (errno) {\n                case ENOSYS:\n                    break; // ok\n                case EINVAL:\n                    break; // ok\n                default:\n                    throw new UnsupportedOperationException(\"prctl(BOGUS_OPTION): \" + libc.strerror(errno));\n            }\n        }\n\n        // now just normal defensive checks\n\n        // check for GET_NO_NEW_PRIVS\n        switch (linuxLibc.prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)) {\n            case 0:\n                break; // not yet set","sourceCodeStart":196,"sourceCodeEnd":232,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java#L196-L232","documentation":"A prctl probe calls prctl(BOGUS_OPTION) expecting -1. If prctl returns success for a bogus option, the prctl interface is not behaving per the Linux ABI and the sandbox code aborts installation. This validates prctl before using it for the NO_NEW_PRIVS and SECCOMP settings.","triggerScenarios":"tryInstallExecSandbox()'s prctl(0xf7a46a5c, 0,0,0,0) probe returns a value other than -1, indicating prctl does not reject unknown options.","commonSituations":"Extremely rare; seen under syscall-emulation or compatibility shims that stub prctl to always succeed. Custom kernels with altered prctl semantics.","solutions":["Run on a mainstream Linux kernel without emulation layers.","Disable the exec sandbox in environments with non-conformant prctl behavior.","File an environment bug; prctl must reject unknown options per the kernel ABI."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// No programmatic pre-check; this is a prctl ABI conformance probe.\n// Run on a standard Linux kernel without prctl emulation.","typeGuard":null,"tryCatchPattern":"try {\n    nativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n    logger.warn(\"Exec sandbox unavailable (prctl probe failed): {}\", e.getMessage());\n}","preventionTips":["Run on a mainstream Linux kernel, not under prctl-emulation shims.","Treat the sandbox as optional; it is not fatal to startup.","If mandatory, validate the host's prctl behavior before deployment."],"tags":["seccomp","security","native","linux","bootstrap","prctl","probe"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}