{"record":{"id":"db33692c0ee130e8","repo":"elastic/elasticsearch","slug":"seccomp-unavailable-requires-kernel-3-5-with-con","errorCode":null,"errorMessage":"seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in","messagePattern":"seccomp unavailable: requires kernel 3\\.5\\+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"warning","filePath":"libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java","lineNumber":239,"sourceCode":"                    break; // ok\n                default:\n                    throw new UnsupportedOperationException(\"prctl(BOGUS_OPTION): \" + libc.strerror(errno));\n            }\n        }\n\n        // now just normal defensive checks\n\n        // check for GET_NO_NEW_PRIVS\n        switch (linuxLibc.prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)) {\n            case 0:\n                break; // not yet set\n            case 1:\n                break; // already set by caller\n            default:\n                int errno = libc.errno();\n                if (errno == EINVAL) {\n                    // friendly error, this will be the typical case for an old kernel\n                    throw new UnsupportedOperationException(\n                        \"seccomp unavailable: requires kernel 3.5+ with\" + \" CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in\"\n                    );\n                } else {\n                    throw new UnsupportedOperationException(\"prctl(PR_GET_NO_NEW_PRIVS): \" + libc.strerror(errno));\n                }\n        }\n        // check for SECCOMP\n        switch (linuxLibc.prctl(PR_GET_SECCOMP, 0, 0, 0, 0)) {\n            case 0:\n                break; // not yet set\n            case 2:\n                break; // already in filter mode by caller\n            default:\n                int errno = libc.errno();\n                if (errno == EINVAL) {\n                    throw new UnsupportedOperationException(\n                        \"seccomp unavailable: CONFIG_SECCOMP not compiled into kernel,\"\n                            + \" CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed\"","sourceCodeStart":221,"sourceCodeEnd":257,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java#L221-L257","documentation":"After the probes, tryInstallExecSandbox checks PR_GET_NO_NEW_PRIVS via prctl. If prctl returns an unexpected value and errno is EINVAL, the kernel predates 3.5 or lacks NO_NEW_PRIVS support, so the friendly message is thrown explaining the kernel/seccomp-config requirement. This is the common, expected failure for old or minimal kernels.","triggerScenarios":"Calling tryInstallExecSandbox() on a Linux kernel older than 3.5, or a kernel compiled without CONFIG_SECCOMP / CONFIG_SECCOMP_FILTER. The PR_GET_NO_NEW_PRIVS prctl returns EINVAL, which is the signature of a kernel lacking this feature.","commonSituations":"Running Elasticsearch on an old distro/kernel (pre-3.5). Custom-compiled kernels with seccomp options disabled. Minimal container base images on stripped kernels. Embedded systems.","solutions":["Upgrade to a Linux kernel 3.5 or newer with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER enabled.","If running in a container, use a host kernel that meets the requirement.","If the sandbox is optional for your deployment, accept this warning; Elasticsearch continues without exec filtering."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Check kernel version / seccomp availability before relying on the sandbox\nString kv = System.getProperty(\"os.version\");\n// best-effort: parse major.minor and require >= 3.5; definitive check is CONFIG_SECCOMP presence\nlogger.info(\"Kernel version: {}\", kv);","typeGuard":"static boolean likelySeccompCapable() {\n    // Heuristic: kernel >= 3.5; definitive test is whether tryInstallExecSandbox succeeds.\n    String v = System.getProperty(\"os.version\");\n    if (v == null) return false;\n    String[] parts = v.split(\"\\\\.\");\n    try {\n        int major = Integer.parseInt(parts[0]);\n        int minor = parts.length > 1 ? Integer.parseInt(parts[1]) : 0;\n        return major > 3 || (major == 3 && minor >= 5);\n    } catch (NumberFormatException e) {\n        return false;\n    }\n}","tryCatchPattern":"try {\n    nativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n    // old kernel or seccomp disabled; sandbox optional\n    logger.warn(\"Exec sandbox unavailable: {}\", e.getMessage());\n}","preventionTips":["Deploy on Linux kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER enabled.","For containers, ensure the host kernel meets the requirement.","Treat the exec sandbox as optional; Elasticsearch runs without it."],"tags":["seccomp","security","kernel","native","linux","bootstrap","config"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}