{"record":{"id":"f16caf5462bd0807","repo":"elastic/elasticsearch","slug":"seccomp-filter-installation-did-not-really-succeed","errorCode":null,"errorMessage":"seccomp filter installation did not really succeed. seccomp(PR_GET_SECCOMP): {}","messagePattern":"seccomp filter installation did not really succeed\\. seccomp\\(PR_GET_SECCOMP\\): (.+?)","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"warning","filePath":"libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java","lineNumber":327,"sourceCode":"        // install filter, if this works, after this there is no going back!\n        // first try it with seccomp(SECCOMP_SET_MODE_FILTER), falling back to prctl()\n        if (linuxLibc.syscall(arch.seccomp, SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, prog) != 0) {\n            method = 0;\n            int errno1 = libc.errno();\n            if (logger.isDebugEnabled()) {\n                logger.debug(\"seccomp(SECCOMP_SET_MODE_FILTER): {}, falling back to prctl(PR_SET_SECCOMP)...\", libc.strerror(errno1));\n            }\n            if (linuxLibc.prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, prog.segment().address(), 0, 0) != 0) {\n                int errno2 = libc.errno();\n                throw new UnsupportedOperationException(\n                    \"seccomp(SECCOMP_SET_MODE_FILTER): \" + libc.strerror(errno1) + \", prctl(PR_SET_SECCOMP): \" + libc.strerror(errno2)\n                );\n            }\n        }\n\n        // now check that the filter was really installed, we should be in filter mode.\n        if (linuxLibc.prctl(PR_GET_SECCOMP, 0, 0, 0, 0) != 2) {\n            throw new UnsupportedOperationException(\n                \"seccomp filter installation did not really succeed. seccomp(PR_GET_SECCOMP): \" + libc.strerror(libc.errno())\n            );\n        }\n\n        logger.debug(\"Linux seccomp filter installation successful, threads: [{}]\", method == 1 ? \"all\" : \"app\");\n        execSandboxState = method == 1 ? ExecSandboxState.ALL_THREADS : ExecSandboxState.EXISTING_THREADS;\n    }\n}\n","sourceCodeStart":309,"sourceCodeEnd":336,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java#L309-L336","documentation":"Thrown during Linux seccomp sandbox setup in tryInstallExecSandbox(). After the BPF filter is installed (either via seccomp() syscall or prctl() fallback returned 0), the code verifies by reading prctl(PR_GET_SECCOMP) and expecting 2 (SECCOMP_MODE_FILTER). If the read-back does not return 2, the filter did not actually take effect despite no error code from the install call. This consistency check catches silent installation failures.","triggerScenarios":"Calling tryInstallExecSandbox() where the BPF filter installation returned success (method variable is 0 or 1) but the subsequent prctl(PR_GET_SECCOMP, 0, 0, 0, 0) returns a value != 2.","commonSituations":"Kernel bugs where PR_SET_SECCOMP returns 0 but does not actually install the filter; race conditions in multi-threaded processes where TSYNC partially fails; niche container runtimes that fake seccomp success. Very rare on healthy mainstream kernels.","solutions":["Read the strerror from PR_GET_SECCOMP in the message.","Check dmesg for kernel audit messages about seccomp filter installation.","Upgrade the kernel — this indicates a kernel or runtime bug.","If unresolvable, accept that the exec sandbox is not active."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    nativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n    // Filter install returned success but PR_GET_SECCOMP != 2.\n    logger.warn(\"seccomp filter verification failed, possible kernel bug: {}\", e.getMessage());\n}","preventionTips":["Keep kernels updated — this is a consistency-check failure indicating a kernel bug.","Avoid container runtimes that fake seccomp success.","Monitor startup logs after kernel or runtime upgrades."],"tags":["linux","seccomp","security","native","kernel","bootstrap","consistency-check"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}