What causes "seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG): {}" in elastic/elasticsearch?

Inspect the strerror; if EPERM/EACCES, adjust the container or host seccomp profile to permit SECCOMP_SET_MODE_FILTER.

elastic/elasticsearch · warning · UnsupportedOperationException

seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG): {}

Error message

seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG): {}

What it means

The seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG) probe returned -1 but with an errno other than ENOSYS/EINVAL. The raw strerror is included. This is the filter-mode variant of the generic bogus-errno probe and catches privilege or memory errors during the capability check.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:207

                    break; // ok
                default:
                    throw new UnsupportedOperationException("seccomp(BOGUS_OPERATION): " + libc.strerror(errno));
            }
        }

        // test seccomp(VALID, BOGUS)
        ret = linuxLibc.syscall(arch.seccomp, SECCOMP_SET_MODE_FILTER, bogusArg, null);
        if (ret != -1) {
            throw new UnsupportedOperationException("seccomp unavailable: seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG) returned " + ret);
        } else {
            int errno = libc.errno();
            switch (errno) {
                case ENOSYS:
                    break; // ok
                case EINVAL:
                    break; // ok
                default:
                    throw new UnsupportedOperationException("seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG): " + libc.strerror(errno));
            }
        }

        // test prctl(BOGUS)
        ret = linuxLibc.prctl(bogusArg, 0, 0, 0, 0);
        if (ret != -1) {
            throw new UnsupportedOperationException("seccomp unavailable: prctl(BOGUS_OPTION) returned " + ret);
        } else {
            int errno = libc.errno();
            switch (errno) {
                case ENOSYS:
                    break; // ok
                case EINVAL:
                    break; // ok
                default:
                    throw new UnsupportedOperationException("prctl(BOGUS_OPTION): " + libc.strerror(errno));
            }
        }

View on GitHub (pinned to db6a809a66)

Solutions

Inspect the strerror; if EPERM/EACCES, adjust the container or host seccomp profile to permit SECCOMP_SET_MODE_FILTER.
Run Elasticsearch with sufficient privileges or disable the inner exec sandbox where the outer policy is authoritative.
Move to an environment without nested seccomp restrictions.

Defensive patterns

Strategy: fallback

Validate before calling

// Cannot pre-check; this surfaces an unexpected errno on the SECCOMP_SET_MODE_FILTER probe.
// Ensure the runtime permits seccomp filter installation.

Try / catch

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("Exec sandbox unavailable: {}", e.getMessage());
}

Prevention

Permit SECCOMP_SET_MODE_FILTER in the container/outer seccomp profile.
Run Elasticsearch with privileges adequate for seccomp, or accept its absence.
Diagnose recurring EPERM/EACCES by inspecting the host/container security policy.

When it happens

Trigger: The SECCOMP_SET_MODE_FILTER probe in tryInstallExecSandbox() fails with an unexpected errno such as EPERM or EACCES, indicating the process lacks permission to use seccomp filters.

Common situations: Container runtimes that forbid SECCOMP_SET_MODE_FILTER via an outer seccomp profile. Running without CAP_SYS_ADMIN where required. Nested sandboxing restrictions.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/b10d6bab86326284. Report an issue: GitHub.