SecComp fails on CentOS 6 #22899

tomsommer · 2017-02-01T10:03:15Z

CentoOS 6 does not (as far as I can research) support SecComp, but ES tries to use it anyway, and fails to start due to bootstrap.system_call_filter: true.

The only workaround currently is to disable bootstrap.system_call_filter

ES 5.2.0

[2017-02-01T10:46:14,173][INFO ][o.e.b.BootstrapChecks    ] [elasticclient] bound or publishing to a non-loopback or non-link-local address, enforcing bootstrap checks
[2017-02-01T10:46:14,175][ERROR][o.e.b.Bootstrap          ] [elasticclient] node validation exception
bootstrap checks failed
system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk

[2017-02-01T10:46:10,639][WARN ][o.e.b.JNANatives         ] unable to install syscall filter:
java.lang.UnsupportedOperationException: seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed
        at org.elasticsearch.bootstrap.SystemCallFilter.linuxImpl(SystemCallFilter.java:363) ~[elasticsearch-5.2.0.jar:5.2.0]
        at org.elasticsearch.bootstrap.SystemCallFilter.init(SystemCallFilter.java:638) ~[elasticsearch-5.2.0.jar:5.2.0]
        at org.elasticsearch.bootstrap.JNANatives.tryInstallSystemCallFilter(JNANatives.java:215) [elasticsearch-5.2.0.jar:5.2.0]
        at org.elasticsearch.bootstrap.Natives.tryInstallSystemCallFilter(Natives.java:99) [elasticsearch-5.2.0.jar:5.2.0]
        at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:110) [elasticsearch-5.2.0.jar:5.2.0]
        at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:203) [elasticsearch-5.2.0.jar:5.2.0]
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:333) [elasticsearch-5.2.0.jar:5.2.0]
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121) [elasticsearch-5.2.0.jar:5.2.0]
        at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:112) [elasticsearch-5.2.0.jar:5.2.0]
        at org.elasticsearch.cli.SettingCommand.execute(SettingCommand.java:54) [elasticsearch-5.2.0.jar:5.2.0]
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:122) [elasticsearch-5.2.0.jar:5.2.0]
        at org.elasticsearch.cli.Command.main(Command.java:88) [elasticsearch-5.2.0.jar:5.2.0]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:89) [elasticsearch-5.2.0.jar:5.2.0]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:82) [elasticsearch-5.2.0.jar:5.2.0]

The text was updated successfully, but these errors were encountered:

jasontedor · 2017-02-01T12:42:58Z

This is operating as designed, and is documented. Your kernel does not support seccomp. Elasticsearch attempts to utilize seccomp by default (via the setting bootstrap.system_call_filter). Starting in 5.2.0, if you're in production mode, bootstrap.system_call_filter is enabled, and initializing seccomp fails, then Elasticsearch will refuse to bootstrap. This to prevent scenarios when seccomp is silently not initialized yet configured to be so. You either have to migrate to a kernel that supports seccomp, or disable bootstrap.system_call_filter.

tomsommer · 2017-02-01T14:51:37Z

Fair enough, https://www.elastic.co/support/matrix might need an update then.

jasontedor · 2017-02-01T14:56:23Z

No, it doesn't. You can still run Elasticsearch on CentOS 6, and we still support it on CentOS 6.

nik9000 · 2017-02-02T02:32:07Z

Maybe we should suppress the stack trace here, leaving the warning. Maybe even explaining that elasticsearch will still run just fine but doesn't have the extra fork protection.

jasontedor · 2017-02-02T03:26:18Z

I don't think we should suppress the stack trace (there's a few different ways this can fail). We say this in the tail of the logs:

[2017-02-02T03:22:24,059][INFO ][o.e.b.BootstrapChecks    ] [2oC8mTv] bound or publishing to a non-loopback or non-link-local address, enforcing bootstrap checks
ERROR: bootstrap checks failed
system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk
[2017-02-02T03:22:24,078][INFO ][o.e.n.Node               ] [2oC8mTv] stopping ...
[2017-02-02T03:22:24,109][INFO ][o.e.n.Node               ] [2oC8mTv] stopped
[2017-02-02T03:22:24,109][INFO ][o.e.n.Node               ] [2oC8mTv] closing ...
[2017-02-02T03:22:24,126][INFO ][o.e.n.Node               ] [2oC8mTv] closed

And the bootstrap check docs say this:

To pass the system call filter check you must either fix any configuration errors on your system that prevented system call filters from installing (check your logs), or at your own risk disable system call filters by setting bootstrap.system_call_filter to false.

tomsommer · 2017-02-02T08:22:06Z

Well, 'at your own risk' makes you go looking for a way to make system call filters work on CentOS 6, which it can't.

You will have all CentOS 6 users setting bootstrap.system_call_filter to false now, and forgetting to unset it when they upgrade to CentOS 7+.

Just my two cents :)

jasontedor · 2017-02-02T14:56:58Z

Okay, but at least they are aware of the problem whereas they weren't before since we silently failed.

dhirenshumsher · 2017-02-13T14:52:24Z

Hi jasontedor, What is a safer way to disable bootstrap.system_call_filter?

datayjz · 2017-02-13T14:58:05Z

in elasticsearch.yml memory after config

jasontedor · 2017-02-13T15:17:20Z

Hi jasontedor, What is a safer way to disable bootstrap.system_call_filter?

Just configure it like you would any other configuration option (e.g., in the elasticsearch.yml).

Exlsunshine · 2017-09-09T01:53:28Z

same reason brings me here, now that it's a warn... I decide to ignore it lol

chitraj8 · 2018-02-05T21:00:49Z

For me it doesnt get the ES started :(

Cavielee · 2019-01-31T10:12:02Z

when i started the sonarqube, i had the same problem. I tried to modify elasticsearch.yml(bootstrap.system_call_filter: false) but there is still the same problem. How can i fix it?

tvernum · 2019-01-31T10:34:14Z

@Cavielee please ask your question on our discussion forum. We cannot diagnose your issue here, but there are people who can help on the forums.

Cavielee · 2019-01-31T11:26:50Z

@Cavielee please ask your question on our discussion forum. We cannot diagnose your issue here, but there are people who can help on the forums.

Thx, i find the way in the docs

xj198806 · 2019-07-23T09:18:40Z

@Cavielee please ask your question on our discussion forum. We cannot diagnose your issue here, but there are people who can help on the forums.

Thx, i find the way in the docs

where is the docs，thks I have the same problem

klin111 · 2022-03-17T04:33:32Z

@Cavielee please ask your question on our discussion forum. We cannot diagnose your issue here, but there are people who can help on the forums.

Thx, i find the way in the docs

where is the docs，thks I have the same problem

the same to me. I found is not system_call_filter done. it's other problem.

klin111 · 2022-03-17T04:35:07Z

@Cavielee please ask your question on our discussion forum. We cannot diagnose your issue here, but there are people who can help on the forums.

Thx, i find the way in the docs
where is the docs，may I hava a look?

jasontedor closed this as completed Feb 1, 2017

inqueue mentioned this issue Feb 14, 2017

Red Hat versions below 7 do not support SECCOMP #23159

Closed

spujadas mentioned this issue Feb 14, 2017

Image run exits with the error : unable to install syscall filter: java.lang.UnsupportedOperationException: seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed spujadas/elk-docker#107

Closed

faxm0dem mentioned this issue Mar 25, 2017

Enhancement: disable seccomp on EL6 voxpupuli/puppet-elasticsearch#798

Open

tgross mentioned this issue Apr 10, 2017

Upgrade to ES 5 autopilotpattern/elasticsearch#8

Open

DimonHo mentioned this issue Aug 2, 2017

Elasticsearch5.5.1安装问题汇总 DimonHo/DH_Note#3

Open

jkakavas mentioned this issue Sep 19, 2018

Build timed out, as SecurityTribeTests were stalled on 6.4 + fipsjvm #33794

Closed

azhavoro mentioned this issue Sep 13, 2022

Unable to revive connection: http://elasticsearch:9200/ cvat-ai/cvat#4765

Closed

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SecComp fails on CentOS 6 #22899

SecComp fails on CentOS 6 #22899

tomsommer commented Feb 1, 2017

jasontedor commented Feb 1, 2017

tomsommer commented Feb 1, 2017

jasontedor commented Feb 1, 2017 •

edited

nik9000 commented Feb 2, 2017

jasontedor commented Feb 2, 2017

tomsommer commented Feb 2, 2017

jasontedor commented Feb 2, 2017

dhirenshumsher commented Feb 13, 2017

datayjz commented Feb 13, 2017

jasontedor commented Feb 13, 2017

Exlsunshine commented Sep 9, 2017

chitraj8 commented Feb 5, 2018

Cavielee commented Jan 31, 2019

tvernum commented Jan 31, 2019

Cavielee commented Jan 31, 2019

xj198806 commented Jul 23, 2019

klin111 commented Mar 17, 2022

klin111 commented Mar 17, 2022

SecComp fails on CentOS 6 #22899

SecComp fails on CentOS 6 #22899

Comments

tomsommer commented Feb 1, 2017

jasontedor commented Feb 1, 2017

tomsommer commented Feb 1, 2017

jasontedor commented Feb 1, 2017 • edited

nik9000 commented Feb 2, 2017

jasontedor commented Feb 2, 2017

tomsommer commented Feb 2, 2017

jasontedor commented Feb 2, 2017

dhirenshumsher commented Feb 13, 2017

datayjz commented Feb 13, 2017

jasontedor commented Feb 13, 2017

Exlsunshine commented Sep 9, 2017

chitraj8 commented Feb 5, 2018

Cavielee commented Jan 31, 2019

tvernum commented Jan 31, 2019

Cavielee commented Jan 31, 2019

xj198806 commented Jul 23, 2019

klin111 commented Mar 17, 2022

klin111 commented Mar 17, 2022

jasontedor commented Feb 1, 2017 •

edited