elastic/elasticsearch · warning · UnsupportedOperationException

seccomp filter installation did not really succeed. seccomp(

Error message

seccomp filter installation did not really succeed. seccomp(PR_GET_SECCOMP): {}

What it means

Thrown during Linux seccomp sandbox setup in tryInstallExecSandbox(). After the BPF filter is installed (either via seccomp() syscall or prctl() fallback returned 0), the code verifies by reading prctl(PR_GET_SECCOMP) and expecting 2 (SECCOMP_MODE_FILTER). If the read-back does not return 2, the filter did not actually take effect despite no error code from the install call. This consistency check catches silent installation failures.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:327

        // install filter, if this works, after this there is no going back!
        // first try it with seccomp(SECCOMP_SET_MODE_FILTER), falling back to prctl()
        if (linuxLibc.syscall(arch.seccomp, SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, prog) != 0) {
            method = 0;
            int errno1 = libc.errno();
            if (logger.isDebugEnabled()) {
                logger.debug("seccomp(SECCOMP_SET_MODE_FILTER): {}, falling back to prctl(PR_SET_SECCOMP)...", libc.strerror(errno1));
            }
            if (linuxLibc.prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, prog.segment().address(), 0, 0) != 0) {
                int errno2 = libc.errno();
                throw new UnsupportedOperationException(
                    "seccomp(SECCOMP_SET_MODE_FILTER): " + libc.strerror(errno1) + ", prctl(PR_SET_SECCOMP): " + libc.strerror(errno2)
                );
            }
        }

        // now check that the filter was really installed, we should be in filter mode.
        if (linuxLibc.prctl(PR_GET_SECCOMP, 0, 0, 0, 0) != 2) {
            throw new UnsupportedOperationException(
                "seccomp filter installation did not really succeed. seccomp(PR_GET_SECCOMP): " + libc.strerror(libc.errno())
            );
        }

        logger.debug("Linux seccomp filter installation successful, threads: [{}]", method == 1 ? "all" : "app");
        execSandboxState = method == 1 ? ExecSandboxState.ALL_THREADS : ExecSandboxState.EXISTING_THREADS;
    }
}

View on GitHub (pinned to db6a809a66)

Solutions

1. Read the strerror from PR_GET_SECCOMP in the message.
2. Check dmesg for kernel audit messages about seccomp filter installation.
3. Upgrade the kernel — this indicates a kernel or runtime bug.
4. If unresolvable, accept that the exec sandbox is not active.

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    // Filter install returned success but PR_GET_SECCOMP != 2.
    logger.warn("seccomp filter verification failed, possible kernel bug: {}", e.getMessage());
}

When it happens

Trigger: Calling tryInstallExecSandbox() where the BPF filter installation returned success (method variable is 0 or 1) but the subsequent prctl(PR_GET_SECCOMP, 0, 0, 0, 0) returns a value != 2.

Common situations: Kernel bugs where PR_SET_SECCOMP returns 0 but does not actually install the filter; race conditions in multi-threaded processes where TSYNC partially fails; niche container runtimes that fake seccomp success. Very rare on healthy mainstream kernels.

Related errors

• seccomp filter did not really succeed: prctl(PR_GET_NO_NEW_P
• seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOM
• prctl(PR_GET_NO_NEW_PRIVS): {}
• seccomp unavailable: CONFIG_SECCOMP not compiled into kernel
• prctl(PR_GET_SECCOMP): {}

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/f16caf5462bd0807. Report an issue: GitHub.