elastic/elasticsearch · warning · UnsupportedOperationException

seccomp(BOGUS_OPERATION): {}

Error message

seccomp(BOGUS_OPERATION): {}

What it means

After the seccomp(BOGUS_OPERATION) probe returns -1, the code inspects errno. ENOSYS and EINVAL are acceptable (means the syscall exists but rejects the bogus op). Any other errno is unexpected and is surfaced verbatim via libc.strerror. This catches pathological seccomp failures such as EFAULT or EPERM on a simple capability probe.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:191

        }

        // try to check system calls really are who they claim
        // you never know (e.g. https://chromium.googlesource.com/chromium/src.git/+/master/sandbox/linux/seccomp-bpf/sandbox_bpf.cc#57)
        final int bogusArg = 0xf7a46a5c;

        // test seccomp(BOGUS)
        long ret = linuxLibc.syscall(arch.seccomp, bogusArg, 0, null);
        if (ret != -1) {
            throw new UnsupportedOperationException("seccomp unavailable: seccomp(BOGUS_OPERATION) returned " + ret);
        } else {
            int errno = libc.errno();
            switch (errno) {
                case ENOSYS:
                    break; // ok
                case EINVAL:
                    break; // ok
                default:
                    throw new UnsupportedOperationException("seccomp(BOGUS_OPERATION): " + libc.strerror(errno));
            }
        }

        // test seccomp(VALID, BOGUS)
        ret = linuxLibc.syscall(arch.seccomp, SECCOMP_SET_MODE_FILTER, bogusArg, null);
        if (ret != -1) {
            throw new UnsupportedOperationException("seccomp unavailable: seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG) returned " + ret);
        } else {
            int errno = libc.errno();
            switch (errno) {
                case ENOSYS:
                    break; // ok
                case EINVAL:
                    break; // ok
                default:
                    throw new UnsupportedOperationException("seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG): " + libc.strerror(errno));
            }
        }

View on GitHub (pinned to db6a809a66)

Solutions

1. Check the strerror text in the message; EPERM usually means the container/host seccomp policy denies the seccomp syscall - relax the outer seccomp profile or run without an inner sandbox.
2. Run Elasticsearch outside of a nested seccomp restriction, or grant CAP_SYS_ADMIN / no_new_privs handling as required.
3. If the strerror indicates a transient resource issue, retry on a clean host.

// Cannot pre-check errno; this surfaces a kernel/libc-level permission or memory error.
// Mitigate by ensuring the process/container is permitted to invoke seccomp(2).

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("Exec sandbox unavailable (seccomp errno {}): {}", errnoIfAny, e.getMessage());
}

When it happens

Trigger: tryInstallExecSandbox()'s seccomp(BOGUS) probe returns -1 with an errno that is neither ENOSYS nor EINVAL (e.g. EPERM due to lack of privileges, EFAULT due to a bad pointer).

Common situations: Running in a heavily restricted container/seccomp profile that blocks the seccomp(2) syscall itself with EPERM. A misconfigured seccomp filter applied by the container runtime before Elasticsearch starts. Corrupted libc bindings.

Related errors

• seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG): {}
• prctl(BOGUS_OPTION): {}
• seccomp unavailable: '{}' architecture unsupported
• seccomp unavailable: seccomp(BOGUS_OPERATION) returned {}
• seccomp unavailable: seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/fe80a4de1e874cad. Report an issue: GitHub.