elastic/elasticsearch · warning · UnsupportedOperationException

prctl(PR_GET_SECCOMP)

Error message

prctl(PR_GET_SECCOMP): {}

What it means

Thrown during Linux seccomp sandbox setup in tryInstallExecSandbox(). The code probes prctl(PR_GET_SECCOMP) to check seccomp mode. It expects 0 (disabled) or 2 (filter mode). A return value in the default branch with errno != EINVAL triggers this generic error with libc.strerror(errno). Unlike error 661 (EINVAL → CONFIG_SECCOMP missing), this fires for any other unexpected errno, meaning the kernel has some seccomp code but the probe returned an abnormal error.

Solutions

  1. Read the strerror value in the exception message to pinpoint the errno.
  2. Check container runtime seccomp/AppArmor/SELinux policies for PR_GET_SECCOMP restrictions.
  3. Verify kernel seccomp support with zcat /proc/config.gz | grep SECCOMP.
  4. Run on a mainstream kernel >= 3.5 without restrictive security modules interfering with prctl.
Defensive patterns

Strategy: try-catch

Try / catch

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("seccomp probe failed unexpectedly: {}", e.getMessage());
}

Prevention

When it happens

Trigger: Calling tryInstallExecSandbox() where prctl(PR_GET_SECCOMP) returns a value other than 0 or 2, and libc.errno() is not EINVAL. The strerror in the message identifies the specific failure.

Common situations: Container seccomp profiles that partially mask PR_GET_SECCOMP; kernel security modules (SELinux, AppArmor) denying the read; rare kernel bugs in backported seccomp patches.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/47ae4f0631af8781. Report an issue: GitHub.

Appendix: source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:260

                } else {
                    throw new UnsupportedOperationException("prctl(PR_GET_NO_NEW_PRIVS): " + libc.strerror(errno));
                }
        }
        // check for SECCOMP
        switch (linuxLibc.prctl(PR_GET_SECCOMP, 0, 0, 0, 0)) {
            case 0:
                break; // not yet set
            case 2:
                break; // already in filter mode by caller
            default:
                int errno = libc.errno();
                if (errno == EINVAL) {
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: CONFIG_SECCOMP not compiled into kernel,"
                            + " CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed"
                    );
                } else {
                    throw new UnsupportedOperationException("prctl(PR_GET_SECCOMP): " + libc.strerror(errno));
                }
        }
        // check for SECCOMP_MODE_FILTER
        if (linuxLibc.prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0) != 0) {
            int errno = libc.errno();
            switch (errno) {
                case EFAULT:
                    break; // available
                case EINVAL:
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: CONFIG_SECCOMP_FILTER not"
                            + " compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed"
                    );
                default:
                    throw new UnsupportedOperationException("prctl(PR_SET_SECCOMP): " + libc.strerror(errno));
            }
        }

View on GitHub (pinned to db6a809a66)