elastic/elasticsearch · warning · UnsupportedOperationException

prctl(PR_GET_SECCOMP): {}

Error message

prctl(PR_GET_SECCOMP): {}

What it means

Thrown during Linux seccomp sandbox setup in tryInstallExecSandbox(). The code probes prctl(PR_GET_SECCOMP) to check seccomp mode. It expects 0 (disabled) or 2 (filter mode). A return value in the default branch with errno != EINVAL triggers this generic error with libc.strerror(errno). Unlike error 661 (EINVAL → CONFIG_SECCOMP missing), this fires for any other unexpected errno, meaning the kernel has some seccomp code but the probe returned an abnormal error.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:260

                } else {
                    throw new UnsupportedOperationException("prctl(PR_GET_NO_NEW_PRIVS): " + libc.strerror(errno));
                }
        }
        // check for SECCOMP
        switch (linuxLibc.prctl(PR_GET_SECCOMP, 0, 0, 0, 0)) {
            case 0:
                break; // not yet set
            case 2:
                break; // already in filter mode by caller
            default:
                int errno = libc.errno();
                if (errno == EINVAL) {
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: CONFIG_SECCOMP not compiled into kernel,"
                            + " CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed"
                    );
                } else {
                    throw new UnsupportedOperationException("prctl(PR_GET_SECCOMP): " + libc.strerror(errno));
                }
        }
        // check for SECCOMP_MODE_FILTER
        if (linuxLibc.prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0) != 0) {
            int errno = libc.errno();
            switch (errno) {
                case EFAULT:
                    break; // available
                case EINVAL:
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: CONFIG_SECCOMP_FILTER not"
                            + " compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed"
                    );
                default:
                    throw new UnsupportedOperationException("prctl(PR_SET_SECCOMP): " + libc.strerror(errno));
            }
        }

View on GitHub (pinned to db6a809a66)

Solutions

1. Read the strerror value in the exception message to pinpoint the errno.
2. Check container runtime seccomp/AppArmor/SELinux policies for PR_GET_SECCOMP restrictions.
3. Verify kernel seccomp support with zcat /proc/config.gz | grep SECCOMP.
4. Run on a mainstream kernel >= 3.5 without restrictive security modules interfering with prctl.

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("seccomp probe failed unexpectedly: {}", e.getMessage());
}

When it happens

Trigger: Calling tryInstallExecSandbox() where prctl(PR_GET_SECCOMP) returns a value other than 0 or 2, and libc.errno() is not EINVAL. The strerror in the message identifies the specific failure.

Common situations: Container seccomp profiles that partially mask PR_GET_SECCOMP; kernel security modules (SELinux, AppArmor) denying the read; rare kernel bugs in backported seccomp patches.

Related errors

• seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOM
• prctl(PR_GET_NO_NEW_PRIVS): {}
• seccomp unavailable: CONFIG_SECCOMP not compiled into kernel
• seccomp unavailable: CONFIG_SECCOMP_FILTER not compiled into
• prctl(PR_SET_SECCOMP): {}

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/47ae4f0631af8781. Report an issue: GitHub.