elastic/elasticsearch · warning · UnsupportedOperationException

seccomp unavailable: CONFIG_SECCOMP_FILTER not compiled into

Error message

seccomp unavailable: CONFIG_SECCOMP_FILTER not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed

What it means

Thrown during Linux seccomp sandbox setup in tryInstallExecSandbox(). After confirming CONFIG_SECCOMP exists (PR_GET_SECCOMP probe passed), the code tests whether filter mode is available by calling prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0) with a NULL argument. If errno is EINVAL, the kernel has CONFIG_SECCOMP but NOT CONFIG_SECCOMP_FILTER — strict mode exists but BPF filter mode does not. The message explicitly names the missing config.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:270

            default:
                int errno = libc.errno();
                if (errno == EINVAL) {
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: CONFIG_SECCOMP not compiled into kernel,"
                            + " CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed"
                    );
                } else {
                    throw new UnsupportedOperationException("prctl(PR_GET_SECCOMP): " + libc.strerror(errno));
                }
        }
        // check for SECCOMP_MODE_FILTER
        if (linuxLibc.prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0) != 0) {
            int errno = libc.errno();
            switch (errno) {
                case EFAULT:
                    break; // available
                case EINVAL:
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: CONFIG_SECCOMP_FILTER not"
                            + " compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed"
                    );
                default:
                    throw new UnsupportedOperationException("prctl(PR_SET_SECCOMP): " + libc.strerror(errno));
            }
        }

        // ok, now set PR_SET_NO_NEW_PRIVS, needed to be able to set a seccomp filter as ordinary user
        if (linuxLibc.prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) {
            throw new UnsupportedOperationException("prctl(PR_SET_NO_NEW_PRIVS): " + libc.strerror(libc.errno()));
        }

        // check it worked
        if (linuxLibc.prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0) != 1) {
            throw new UnsupportedOperationException(
                "seccomp filter did not really succeed: prctl(PR_GET_NO_NEW_PRIVS): " + libc.strerror(libc.errno())
            );

View on GitHub (pinned to db6a809a66)

Solutions

1. Recompile the kernel with CONFIG_SECCOMP_FILTER=y (in addition to CONFIG_SECCOMP=y).
2. Upgrade to a mainstream distribution kernel where CONFIG_SECCOMP_FILTER is default.
3. If the kernel cannot be changed, accept that the BPF-based exec sandbox is unavailable.

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    // Kernel has CONFIG_SECCOMP but not CONFIG_SECCOMP_FILTER.
    logger.warn("seccomp filter mode unavailable: {}", e.getMessage());
}

When it happens

Trigger: Calling tryInstallExecSandbox() on a kernel where prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0) returns non-zero with errno == EINVAL. This means CONFIG_SECCOMP=y but CONFIG_SECCOMP_FILTER is not set. Note: EFAULT is treated as 'available' because passing NULL is expected to fault, confirming the code path exists.

Common situations: Kernels between 3.5 that enabled CONFIG_SECCOMP for strict mode but omitted CONFIG_SECCOMP_FILTER; some older enterprise LTS kernels with partial backports; minimal cloud kernels.

Related errors

• seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOM
• prctl(PR_GET_NO_NEW_PRIVS): {}
• seccomp unavailable: CONFIG_SECCOMP not compiled into kernel
• prctl(PR_GET_SECCOMP): {}
• prctl(PR_SET_SECCOMP): {}

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/7374f671a7513ed8. Report an issue: GitHub.