What causes "seccomp unavailable: prctl(BOGUS_OPTION) returned {}" in elastic/elasticsearch?

Run on a mainstream Linux kernel without emulation layers.

elastic/elasticsearch · warning · UnsupportedOperationException

seccomp unavailable: prctl(BOGUS_OPTION) returned {}

Error message

seccomp unavailable: prctl(BOGUS_OPTION) returned {}

What it means

A prctl probe calls prctl(BOGUS_OPTION) expecting -1. If prctl returns success for a bogus option, the prctl interface is not behaving per the Linux ABI and the sandbox code aborts installation. This validates prctl before using it for the NO_NEW_PRIVS and SECCOMP settings.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:214

        ret = linuxLibc.syscall(arch.seccomp, SECCOMP_SET_MODE_FILTER, bogusArg, null);
        if (ret != -1) {
            throw new UnsupportedOperationException("seccomp unavailable: seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG) returned " + ret);
        } else {
            int errno = libc.errno();
            switch (errno) {
                case ENOSYS:
                    break; // ok
                case EINVAL:
                    break; // ok
                default:
                    throw new UnsupportedOperationException("seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG): " + libc.strerror(errno));
            }
        }

        // test prctl(BOGUS)
        ret = linuxLibc.prctl(bogusArg, 0, 0, 0, 0);
        if (ret != -1) {
            throw new UnsupportedOperationException("seccomp unavailable: prctl(BOGUS_OPTION) returned " + ret);
        } else {
            int errno = libc.errno();
            switch (errno) {
                case ENOSYS:
                    break; // ok
                case EINVAL:
                    break; // ok
                default:
                    throw new UnsupportedOperationException("prctl(BOGUS_OPTION): " + libc.strerror(errno));
            }
        }

        // now just normal defensive checks

        // check for GET_NO_NEW_PRIVS
        switch (linuxLibc.prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)) {
            case 0:
                break; // not yet set

View on GitHub (pinned to db6a809a66)

Solutions

Run on a mainstream Linux kernel without emulation layers.
Disable the exec sandbox in environments with non-conformant prctl behavior.
File an environment bug; prctl must reject unknown options per the kernel ABI.

Defensive patterns

Strategy: fallback

Validate before calling

// No programmatic pre-check; this is a prctl ABI conformance probe.
// Run on a standard Linux kernel without prctl emulation.

Try / catch

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("Exec sandbox unavailable (prctl probe failed): {}", e.getMessage());
}

Prevention

Run on a mainstream Linux kernel, not under prctl-emulation shims.
Treat the sandbox as optional; it is not fatal to startup.
If mandatory, validate the host's prctl behavior before deployment.

When it happens

Trigger: tryInstallExecSandbox()'s prctl(0xf7a46a5c, 0,0,0,0) probe returns a value other than -1, indicating prctl does not reject unknown options.

Common situations: Extremely rare; seen under syscall-emulation or compatibility shims that stub prctl to always succeed. Custom kernels with altered prctl semantics.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/bd93e509583acedb. Report an issue: GitHub.