elastic/elasticsearch · warning · UnsupportedOperationException

prctl(PR_SET_SECCOMP)

Error message

prctl(PR_SET_SECCOMP): {}

What it means

Thrown during Linux seccomp sandbox setup in tryInstallExecSandbox(). The code tests filter-mode availability with prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0). EFAULT is treated as 'filter mode available' (NULL arg expectedly faults); EINVAL means CONFIG_SECCOMP_FILTER is missing (error 663). This default branch catches any other errno, appending strerror. It means the kernel has the code path but something else blocked the probe.

Solutions

  1. Read the strerror in the exception to identify the errno.
  2. Check container and host security module policies for PR_SET_SECCOMP restrictions.
  3. Verify kernel config has both CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER.
  4. Run on an unmodified mainstream kernel to rule out security-module interference.
Defensive patterns

Strategy: try-catch

Try / catch

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("seccomp filter probe failed unexpectedly: {}", e.getMessage());
}

Prevention

When it happens

Trigger: Calling tryInstallExecSandbox() where the SECCOMP_MODE_FILTER probe returns non-zero with errno that is neither EFAULT nor EINVAL.

Common situations: Security modules (SELinux, AppArmor) blocking the prctl; container runtimes with seccomp profiles filtering PR_SET_SECCOMP; kernel hardening patches that reject the probe.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/b0105d352171a347. Report an issue: GitHub.

Appendix: source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:275

                            + " CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed"
                    );
                } else {
                    throw new UnsupportedOperationException("prctl(PR_GET_SECCOMP): " + libc.strerror(errno));
                }
        }
        // check for SECCOMP_MODE_FILTER
        if (linuxLibc.prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0) != 0) {
            int errno = libc.errno();
            switch (errno) {
                case EFAULT:
                    break; // available
                case EINVAL:
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: CONFIG_SECCOMP_FILTER not"
                            + " compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed"
                    );
                default:
                    throw new UnsupportedOperationException("prctl(PR_SET_SECCOMP): " + libc.strerror(errno));
            }
        }

        // ok, now set PR_SET_NO_NEW_PRIVS, needed to be able to set a seccomp filter as ordinary user
        if (linuxLibc.prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) {
            throw new UnsupportedOperationException("prctl(PR_SET_NO_NEW_PRIVS): " + libc.strerror(libc.errno()));
        }

        // check it worked
        if (linuxLibc.prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0) != 1) {
            throw new UnsupportedOperationException(
                "seccomp filter did not really succeed: prctl(PR_GET_NO_NEW_PRIVS): " + libc.strerror(libc.errno())
            );
        }

        // BPF installed to check arch, limit, then syscall.
        // See https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt for details.
        SockFilter insns[] = {

View on GitHub (pinned to db6a809a66)