{"record":{"id":"12987abdf2dc8c07","repo":"elastic/elasticsearch","slug":"queryinformationjobobject","errorCode":null,"errorMessage":"QueryInformationJobObject: {}","messagePattern":"QueryInformationJobObject: (.+?)","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"libs/native/src/main/java/org/elasticsearch/nativeaccess/WindowsNativeAccess.java","lineNumber":167,"sourceCode":"     * Process creation is restricted with {@code SetInformationJobObject/ActiveProcessLimit}.\n     * <p>\n     * Note: This is not intended as a real sandbox. It is another level of security, mostly intended to annoy\n     * security researchers and make their lives more difficult in achieving \"remote execution\" exploits.\n     */\n    @Override\n    public void tryInstallExecSandbox() {\n        // create a new Job\n        Handle job = kernel.CreateJobObjectW();\n        if (job == null) {\n            throw new UnsupportedOperationException(\"CreateJobObject: \" + kernel.GetLastError());\n        }\n\n        try {\n            // retrieve the current basic limits of the job\n            int clazz = JOBOBJECT_BASIC_LIMIT_INFORMATION_CLASS;\n            var info = kernel.newJobObjectBasicLimitInformation();\n            if (kernel.QueryInformationJobObject(job, clazz, info) == false) {\n                throw new UnsupportedOperationException(\"QueryInformationJobObject: \" + kernel.GetLastError());\n            }\n            // modify the number of active processes to be 1 (exactly the one process we will add to the job).\n            info.setActiveProcessLimit(1);\n            info.setLimitFlags(JOB_OBJECT_LIMIT_ACTIVE_PROCESS);\n            if (kernel.SetInformationJobObject(job, clazz, info) == false) {\n                throw new UnsupportedOperationException(\"SetInformationJobObject: \" + kernel.GetLastError());\n            }\n            // assign ourselves to the job\n            if (kernel.AssignProcessToJobObject(job, kernel.GetCurrentProcess()) == false) {\n                throw new UnsupportedOperationException(\"AssignProcessToJobObject: \" + kernel.GetLastError());\n            }\n        } finally {\n            kernel.CloseHandle(job);\n        }\n\n        execSandboxState = ExecSandboxState.ALL_THREADS;\n        logger.debug(\"Windows ActiveProcessLimit initialization successful\");\n    }","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/WindowsNativeAccess.java#L149-L185","documentation":"Thrown as UnsupportedOperationException when kernel32.QueryInformationJobObject() returns false after the job object was successfully created. The message includes GetLastError(). This means the job handle is valid but the system refused to read its current limits, which can happen with permission restrictions or handle access mask mismatches.","triggerScenarios":"Calling tryInstallExecSandbox() where QueryInformationJobObject(job, JOBOBJECT_BASIC_LIMIT_INFORMATION, info) fails. The job was created (CreateJobObjectW succeeded) but querying its limits is denied.","commonSituations":"The job object's default security descriptor denies the calling token QUERY access. Running under a low-privilege account. Windows version-specific ACL behavior on job objects. Rare kernel bug.","solutions":["Decode the GetLastError() code with 'net helpmsg <code>'.","Ensure the service account has the right to query job object information.","If this persists, the exec sandbox cannot be installed; catch the exception and continue without it.","Check if another security product (antivirus, EDR) is interfering with job object queries."],"exampleFix":"// before\nwindowsNativeAccess.tryInstallExecSandbox();\n\n// after\ntry {\n    windowsNativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n    logger.warn(\"Could not query Windows job object limits; exec sandbox not installed\", e);\n}","handlingStrategy":"try-catch","validationCode":"// No pre-check available for QueryInformationJobObject; use try-catch.\n// Verify the account has job-object query rights via Windows security policy.","typeGuard":null,"tryCatchPattern":"try {\n    nativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n    logger.warn(\"QueryInformationJobObject failed; exec sandbox unavailable\", e);\n}","preventionTips":["Ensure the service account can both create and query job objects.","Check for EDR/antivirus interference with Win32 job APIs.","Treat sandbox installation as best-effort on Windows."],"tags":["windows","native","security","sandbox","kernel32","job-object"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}