\n * Process creation is restricted with {@code SetInformationJobObject/ActiveProcessLimit}.\n *
\n * Note: This is not intended as a real sandbox. It is another level of security, mostly intended to annoy\n * security researchers and make their lives more difficult in achieving \"remote execution\" exploits.\n */\n @Override\n public void tryInstallExecSandbox() {\n // create a new Job\n Handle job = kernel.CreateJobObjectW();\n if (job == null) {\n throw new UnsupportedOperationException(\"CreateJobObject: \" + kernel.GetLastError());\n }\n\n try {\n // retrieve the current basic limits of the job\n int clazz = JOBOBJECT_BASIC_LIMIT_INFORMATION_CLASS;\n var info = kernel.newJobObjectBasicLimitInformation();\n if (kernel.QueryInformationJobObject(job, clazz, info) == false) {\n throw new UnsupportedOperationException(\"QueryInformationJobObject: \" + kernel.GetLastError());\n }\n // modify the number of active processes to be 1 (exactly the one process we will add to the job).\n info.setActiveProcessLimit(1);\n info.setLimitFlags(JOB_OBJECT_LIMIT_ACTIVE_PROCESS);\n if (kernel.SetInformationJobObject(job, clazz, info) == false) {\n throw new UnsupportedOperationException(\"SetInformationJobObject: \" + kernel.GetLastError());\n }\n // assign ourselves to the job\n if (kernel.AssignProcessToJobObject(job, kernel.GetCurrentProcess()) == false) {\n throw new UnsupportedOperationException(\"AssignProcessToJobObject: \" + kernel.GetLastError());","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/WindowsNativeAccess.java#L141-L177","documentation":"Thrown as UnsupportedOperationException from tryInstallExecSandbox() when kernel32.CreateJobObjectW() returns a null handle. The message includes the GetLastError() numeric code. This blocks installation of the Windows exec sandbox (ActiveProcessLimit=1) that prevents the Elasticsearch process from spawning arbitrary child processes as a defense-in-depth measure.","triggerScenarios":"Calling tryInstallExecSandbox() on Windows when the process lacks the privilege to create a job object, or under resource exhaustion. CreateJobObjectW returns NULL and GetLastError reports the denial code.","commonSituations":"Running under a restricted service account without SeAssignPrimaryTokenPrivilege. Windows resource quota exhaustion (handle table full). Group Policy disallowing job object creation. Running in a nested container/sandbox that already restricts job creation.","solutions":["Decode the error code: run 'net helpmsg ' in cmd to get the Windows error description.","Ensure the Elasticsearch service account has sufficient privileges to create job objects.","If running in a container or nested sandbox, this is expected; the exec sandbox is best-effort.","Consult Windows event logs for security audit entries related to privilege use."],"exampleFix":"// before: unguarded sandbox installation\nwindowsNativeAccess.tryInstallExecSandbox();\n\n// after: best-effort with fallback\ntry {\n windowsNativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n logger.warn(\"Could not install Windows exec sandbox; continuing without it\", e);\n}","handlingStrategy":"try-catch","validationCode":"// On Windows, check OS before attempting sandbox installation.\n// No pure Java pre-check for CreateJobObjectW availability; use try-catch.\nif (!System.getProperty(\"os.name\").toLowerCase().contains(\"windows\")) {\n return; // sandbox is Windows-only\n}","typeGuard":null,"tryCatchPattern":"try {\n nativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n logger.warn(\"Windows exec sandbox installation failed; process runs without ActiveProcessLimit restriction\", e);\n}","preventionTips":["Run Elasticsearch under an account with job-object creation privileges on Windows.","Treat the exec sandbox as best-effort; always catch UnsupportedOperationException.","Check Windows Event Viewer for privilege-denied audit entries."],"tags":["windows","native","security","sandbox","kernel32","job-object"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}