elastic/elasticsearch · warning · UnsupportedOperationException

seccomp unavailable: seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_

Error message

seccomp unavailable: seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG) returned {}

What it means

A second probe calls seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG) with a valid operation but an invalid flag. It must return -1; if it returns success the implementation is broken and the sandbox refuses to install. This verifies that the seccomp filter-mode operation properly rejects bad flags before relying on it.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:198

        long ret = linuxLibc.syscall(arch.seccomp, bogusArg, 0, null);
        if (ret != -1) {
            throw new UnsupportedOperationException("seccomp unavailable: seccomp(BOGUS_OPERATION) returned " + ret);
        } else {
            int errno = libc.errno();
            switch (errno) {
                case ENOSYS:
                    break; // ok
                case EINVAL:
                    break; // ok
                default:
                    throw new UnsupportedOperationException("seccomp(BOGUS_OPERATION): " + libc.strerror(errno));
            }
        }

        // test seccomp(VALID, BOGUS)
        ret = linuxLibc.syscall(arch.seccomp, SECCOMP_SET_MODE_FILTER, bogusArg, null);
        if (ret != -1) {
            throw new UnsupportedOperationException("seccomp unavailable: seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG) returned " + ret);
        } else {
            int errno = libc.errno();
            switch (errno) {
                case ENOSYS:
                    break; // ok
                case EINVAL:
                    break; // ok
                default:
                    throw new UnsupportedOperationException("seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG): " + libc.strerror(errno));
            }
        }

        // test prctl(BOGUS)
        ret = linuxLibc.prctl(bogusArg, 0, 0, 0, 0);
        if (ret != -1) {
            throw new UnsupportedOperationException("seccomp unavailable: prctl(BOGUS_OPTION) returned " + ret);
        } else {
            int errno = libc.errno();

View on GitHub (pinned to db6a809a66)

Solutions

Run on a mainstream Linux kernel without syscall emulation layers.
Disable the Elasticsearch exec sandbox in environments known to misreport seccomp behavior.
Verify the kernel is unmodified with a standalone seccomp capability test.

Defensive patterns

Strategy: fallback

Validate before calling

// No programmatic pre-check; this is a kernel ABI conformance probe for SECCOMP_SET_MODE_FILTER.
// Run on a standard Linux kernel without syscall emulation.

Try / catch

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("Exec sandbox unavailable (seccomp filter probe failed): {}", e.getMessage());
}

Prevention

Use a mainstream Linux kernel (3.17+ for SECCOMP_SET_MODE_FILTER).
Avoid syscall-emulation runtimes that misreport seccomp behavior.
Treat the exec sandbox as best-effort in emulated environments.

When it happens

Trigger: tryInstallExecSandbox() probes seccomp(SECCOMP_SET_MODE_FILTER, 0xf7a46a5c, null) and the kernel returns a non-(-1) value, indicating it accepted a bogus flag.

Common situations: Same class of rare environments as the BOGUS_OPERATION probe: syscall-emulation runtimes, custom kernels, or sandboxes that stub seccomp calls to always succeed. Seen under some userspace syscall shims.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/018c6c26f3fe1a97. Report an issue: GitHub.