What causes "seccomp unavailable: seccomp(BOGUS_OPERATION) returned {}" in elastic/elasticsearch?

Run on a mainstream Linux kernel (3.17+) with a standard libc, not under a syscall-emulation layer.

elastic/elasticsearch · warning · UnsupportedOperationException

seccomp unavailable: seccomp(BOGUS_OPERATION) returned {}

Error message

seccomp unavailable: seccomp(BOGUS_OPERATION) returned {}

What it means

As a sanity probe, tryInstallExecSandbox calls seccomp(BOGUS_OPERATION) expecting it to fail with -1. If the syscall instead returns a non-negative value, the kernel/libc is behaving incorrectly for a bogus operation code, so the sandbox code refuses to proceed. This guards against a seccomp implementation that does not reject unknown operations.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:182

     */
    @Override
    public void tryInstallExecSandbox() {
        // first be defensive: we can give nice errors this way, at the very least.
        // also, some of these security features get backported to old versions, checking kernel version here is a big no-no!
        String archId = System.getProperty("os.arch");
        final Arch arch = ARCHITECTURES.get(archId);
        if (arch == null) {
            throw new UnsupportedOperationException("seccomp unavailable: '" + archId + "' architecture unsupported");
        }

        // try to check system calls really are who they claim
        // you never know (e.g. https://chromium.googlesource.com/chromium/src.git/+/master/sandbox/linux/seccomp-bpf/sandbox_bpf.cc#57)
        final int bogusArg = 0xf7a46a5c;

        // test seccomp(BOGUS)
        long ret = linuxLibc.syscall(arch.seccomp, bogusArg, 0, null);
        if (ret != -1) {
            throw new UnsupportedOperationException("seccomp unavailable: seccomp(BOGUS_OPERATION) returned " + ret);
        } else {
            int errno = libc.errno();
            switch (errno) {
                case ENOSYS:
                    break; // ok
                case EINVAL:
                    break; // ok
                default:
                    throw new UnsupportedOperationException("seccomp(BOGUS_OPERATION): " + libc.strerror(errno));
            }
        }

        // test seccomp(VALID, BOGUS)
        ret = linuxLibc.syscall(arch.seccomp, SECCOMP_SET_MODE_FILTER, bogusArg, null);
        if (ret != -1) {
            throw new UnsupportedOperationException("seccomp unavailable: seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG) returned " + ret);
        } else {
            int errno = libc.errno();

View on GitHub (pinned to db6a809a66)

Solutions

Run on a mainstream Linux kernel (3.17+) with a standard libc, not under a syscall-emulation layer.
If running under gVisor/qemu-user or a custom seccomp shim, disable the exec sandbox for that environment.
Report the environment details; this indicates the seccomp surface is not behaving per the Linux ABI.

Defensive patterns

Strategy: fallback

Validate before calling

// No programmatic pre-check; this is a kernel ABI conformance probe.
// Best validation is to run on a standard Linux kernel without syscall emulation.

Try / catch

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("Exec sandbox unavailable (seccomp probe failed): {}", e.getMessage());
    // continue without sandbox
}

Prevention

Run on a mainstream Linux kernel, not under gVisor/qemu-user/syscall shims.
Treat the exec sandbox as optional; Elasticsearch starts without it.
If the sandbox is mandatory for your policy, validate the host with a standalone seccomp test before deploying.

When it happens

Trigger: Calling tryInstallExecSandbox() on a system where the seccomp(2) syscall accepts an invalid operation (0xf7a46a5c) and returns success instead of -1. This is a defensive probe failure indicating a broken or non-conformant seccomp implementation.

Common situations: Extremely rare. Could occur under compatibility/translation layers (e.g. syscall emulation in some container runtimes, gVisor, qemu user-mode) that mishandle unknown seccomp operations. Custom or patched kernels that alter seccomp semantics.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/890d64e1b866fcb8. Report an issue: GitHub.