elastic/elasticsearch · warning · UnsupportedOperationException

prctl(BOGUS_OPTION)

Error message

prctl(BOGUS_OPTION): {}

What it means

The prctl(BOGUS_OPTION) probe returned -1 but with an errno that is neither ENOSYS nor EINVAL. The strerror is appended. This catches unexpected failures of the prctl capability probe itself, such as privilege denials.

Solutions

  1. Read the strerror; EPERM/EACCES suggests an outer policy blocks prctl - relax it or disable the inner sandbox.
  2. Run on an unrestricted host to isolate whether the restriction is container-imposed.
  3. If strerror indicates ENOSYS-style absence, upgrade to a kernel with prctl support.
Defensive patterns

Strategy: fallback

Validate before calling

// Cannot pre-check; this surfaces an unexpected errno on the prctl bogus-option probe.
// Ensure the runtime permits prctl calls.

Try / catch

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("Exec sandbox unavailable (prctl errno): {}", e.getMessage());
}

Prevention

When it happens

Trigger: tryInstallExecSandbox()'s prctl(BOGUS) probe fails with an unexpected errno (e.g. EPERM) rather than the expected ENOSYS/EINVAL.

Common situations: Outer seccomp/LSM policies that block prctl outright. Containers with restricted prctl access. Kernel or libc corruption.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/861cba525c505003. Report an issue: GitHub.

Appendix: source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:223

                    break; // ok
                default:
                    throw new UnsupportedOperationException("seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG): " + libc.strerror(errno));
            }
        }

        // test prctl(BOGUS)
        ret = linuxLibc.prctl(bogusArg, 0, 0, 0, 0);
        if (ret != -1) {
            throw new UnsupportedOperationException("seccomp unavailable: prctl(BOGUS_OPTION) returned " + ret);
        } else {
            int errno = libc.errno();
            switch (errno) {
                case ENOSYS:
                    break; // ok
                case EINVAL:
                    break; // ok
                default:
                    throw new UnsupportedOperationException("prctl(BOGUS_OPTION): " + libc.strerror(errno));
            }
        }

        // now just normal defensive checks

        // check for GET_NO_NEW_PRIVS
        switch (linuxLibc.prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)) {
            case 0:
                break; // not yet set
            case 1:
                break; // already set by caller
            default:
                int errno = libc.errno();
                if (errno == EINVAL) {
                    // friendly error, this will be the typical case for an old kernel
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: requires kernel 3.5+ with" + " CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in"
                    );

View on GitHub (pinned to db6a809a66)