elastic/elasticsearch · warning · UnsupportedOperationException

seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOM

Error message

seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in

What it means

After the probes, tryInstallExecSandbox checks PR_GET_NO_NEW_PRIVS via prctl. If prctl returns an unexpected value and errno is EINVAL, the kernel predates 3.5 or lacks NO_NEW_PRIVS support, so the friendly message is thrown explaining the kernel/seccomp-config requirement. This is the common, expected failure for old or minimal kernels.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:239

                    break; // ok
                default:
                    throw new UnsupportedOperationException("prctl(BOGUS_OPTION): " + libc.strerror(errno));
            }
        }

        // now just normal defensive checks

        // check for GET_NO_NEW_PRIVS
        switch (linuxLibc.prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)) {
            case 0:
                break; // not yet set
            case 1:
                break; // already set by caller
            default:
                int errno = libc.errno();
                if (errno == EINVAL) {
                    // friendly error, this will be the typical case for an old kernel
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: requires kernel 3.5+ with" + " CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in"
                    );
                } else {
                    throw new UnsupportedOperationException("prctl(PR_GET_NO_NEW_PRIVS): " + libc.strerror(errno));
                }
        }
        // check for SECCOMP
        switch (linuxLibc.prctl(PR_GET_SECCOMP, 0, 0, 0, 0)) {
            case 0:
                break; // not yet set
            case 2:
                break; // already in filter mode by caller
            default:
                int errno = libc.errno();
                if (errno == EINVAL) {
                    throw new UnsupportedOperationException(
                        "seccomp unavailable: CONFIG_SECCOMP not compiled into kernel,"
                            + " CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed"

View on GitHub (pinned to db6a809a66)

Solutions

1. Upgrade to a Linux kernel 3.5 or newer with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER enabled.
2. If running in a container, use a host kernel that meets the requirement.
3. If the sandbox is optional for your deployment, accept this warning; Elasticsearch continues without exec filtering.

// Check kernel version / seccomp availability before relying on the sandbox
String kv = System.getProperty("os.version");
// best-effort: parse major.minor and require >= 3.5; definitive check is CONFIG_SECCOMP presence
logger.info("Kernel version: {}", kv);

static boolean likelySeccompCapable() {
    // Heuristic: kernel >= 3.5; definitive test is whether tryInstallExecSandbox succeeds.
    String v = System.getProperty("os.version");
    if (v == null) return false;
    String[] parts = v.split("\\.");
    try {
        int major = Integer.parseInt(parts[0]);
        int minor = parts.length > 1 ? Integer.parseInt(parts[1]) : 0;
        return major > 3 || (major == 3 && minor >= 5);
    } catch (NumberFormatException e) {
        return false;
    }
}

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    // old kernel or seccomp disabled; sandbox optional
    logger.warn("Exec sandbox unavailable: {}", e.getMessage());
}

When it happens

Trigger: Calling tryInstallExecSandbox() on a Linux kernel older than 3.5, or a kernel compiled without CONFIG_SECCOMP / CONFIG_SECCOMP_FILTER. The PR_GET_NO_NEW_PRIVS prctl returns EINVAL, which is the signature of a kernel lacking this feature.

Common situations: Running Elasticsearch on an old distro/kernel (pre-3.5). Custom-compiled kernels with seccomp options disabled. Minimal container base images on stripped kernels. Embedded systems.

Related errors

• prctl(PR_GET_NO_NEW_PRIVS): {}
• seccomp unavailable: CONFIG_SECCOMP not compiled into kernel
• prctl(PR_GET_SECCOMP): {}
• seccomp unavailable: CONFIG_SECCOMP_FILTER not compiled into
• prctl(PR_SET_SECCOMP): {}

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/db33692c0ee130e8. Report an issue: GitHub.