elastic/elasticsearch · warning · UnsupportedOperationException

seccomp unavailable: CONFIG_SECCOMP not compiled into kernel

Error message

seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed

What it means

Thrown during Linux seccomp sandbox setup in tryInstallExecSandbox(). After the PR_GET_NO_NEW_PRIVS probe passes, the code calls prctl(PR_GET_SECCOMP) to check whether the kernel has the seccomp subsystem at all. If the return falls into the default branch and errno is EINVAL, the kernel was compiled without CONFIG_SECCOMP. This is the 'friendly error' for old or stripped-down kernels — the message explicitly names the missing config option.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:255

                if (errno == EINVAL) {
                    // friendly error, this will be the typical case for an old kernel
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: requires kernel 3.5+ with" + " CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in"
                    );
                } else {
                    throw new UnsupportedOperationException("prctl(PR_GET_NO_NEW_PRIVS): " + libc.strerror(errno));
                }
        }
        // check for SECCOMP
        switch (linuxLibc.prctl(PR_GET_SECCOMP, 0, 0, 0, 0)) {
            case 0:
                break; // not yet set
            case 2:
                break; // already in filter mode by caller
            default:
                int errno = libc.errno();
                if (errno == EINVAL) {
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: CONFIG_SECCOMP not compiled into kernel,"
                            + " CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed"
                    );
                } else {
                    throw new UnsupportedOperationException("prctl(PR_GET_SECCOMP): " + libc.strerror(errno));
                }
        }
        // check for SECCOMP_MODE_FILTER
        if (linuxLibc.prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 0, 0, 0) != 0) {
            int errno = libc.errno();
            switch (errno) {
                case EFAULT:
                    break; // available
                case EINVAL:
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: CONFIG_SECCOMP_FILTER not"
                            + " compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed"
                    );

View on GitHub (pinned to db6a809a66)

Solutions

Recompile the kernel with CONFIG_SECCOMP=y and CONFIG_SECCOMP_FILTER=y.
Upgrade to a mainstream distribution kernel (>= 3.5) where these options are default-enabled.
If you cannot change the kernel, accept that the exec sandbox is unavailable — ES will log the exception and bootstrap logic determines whether startup is blocked.

Defensive patterns

Strategy: try-catch

Try / catch

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    // Kernel lacks CONFIG_SECCOMP entirely.
    logger.warn("seccomp unavailable (kernel compiled without CONFIG_SECCOMP): {}", e.getMessage());
}

Prevention

Provision servers with mainstream distribution kernels that default CONFIG_SECCOMP=y.
For custom/embedded kernels, always set CONFIG_SECCOMP=y and CONFIG_SECCOMP_FILTER=y.
Document the kernel config requirements in your deployment runbook.

When it happens

Trigger: Calling tryInstallExecSandbox() on a Linux kernel where prctl(PR_GET_SECCOMP, 0, 0, 0, 0) returns a value other than 0 or 2 (the two valid modes), and libc.errno() == EINVAL. This means the kernel has no seccomp code compiled in at all.

Common situations: Embedded or minimal kernel builds (OpenWrt, custom Yocto kernels); very old kernels predating 3.5; cloud-provider custom kernels that strip CONFIG_SECCOMP for attack-surface reduction; CI environments using stripped VM kernels.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/66d41f64a67c8a91. Report an issue: GitHub.