{"record":{"id":"c4887baa1ace4b6d","repo":"elastic/elasticsearch","slug":"setinformationjobobject","errorCode":null,"errorMessage":"SetInformationJobObject: {}","messagePattern":"SetInformationJobObject: (.+?)","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"libs/native/src/main/java/org/elasticsearch/nativeaccess/WindowsNativeAccess.java","lineNumber":173,"sourceCode":"    public void tryInstallExecSandbox() {\n        // create a new Job\n        Handle job = kernel.CreateJobObjectW();\n        if (job == null) {\n            throw new UnsupportedOperationException(\"CreateJobObject: \" + kernel.GetLastError());\n        }\n\n        try {\n            // retrieve the current basic limits of the job\n            int clazz = JOBOBJECT_BASIC_LIMIT_INFORMATION_CLASS;\n            var info = kernel.newJobObjectBasicLimitInformation();\n            if (kernel.QueryInformationJobObject(job, clazz, info) == false) {\n                throw new UnsupportedOperationException(\"QueryInformationJobObject: \" + kernel.GetLastError());\n            }\n            // modify the number of active processes to be 1 (exactly the one process we will add to the job).\n            info.setActiveProcessLimit(1);\n            info.setLimitFlags(JOB_OBJECT_LIMIT_ACTIVE_PROCESS);\n            if (kernel.SetInformationJobObject(job, clazz, info) == false) {\n                throw new UnsupportedOperationException(\"SetInformationJobObject: \" + kernel.GetLastError());\n            }\n            // assign ourselves to the job\n            if (kernel.AssignProcessToJobObject(job, kernel.GetCurrentProcess()) == false) {\n                throw new UnsupportedOperationException(\"AssignProcessToJobObject: \" + kernel.GetLastError());\n            }\n        } finally {\n            kernel.CloseHandle(job);\n        }\n\n        execSandboxState = ExecSandboxState.ALL_THREADS;\n        logger.debug(\"Windows ActiveProcessLimit initialization successful\");\n    }\n\n    @Override\n    public OptionalLong allocatedSizeInBytes(Path path) {\n        assert Files.isRegularFile(path) : path;\n        String fileName = \"\\\\\\\\?\\\\\" + path;\n        AtomicInteger lpFileSizeHigh = new AtomicInteger();","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/WindowsNativeAccess.java#L155-L191","documentation":"Thrown as UnsupportedOperationException when kernel32.SetInformationJobObject() returns false after querying the job's limits succeeded. The message includes GetLastError(). This means the process could create and read the job but was denied permission to modify its limits (specifically setting ActiveProcessLimit=1 and JOB_OBJECT_LIMIT_ACTIVE_PROCESS).","triggerScenarios":"Calling tryInstallExecSandbox() where SetInformationJobObject(job, JOBOBJECT_BASIC_LIMIT_INFORMATION, info) fails. The job handle's ACL denies SET_INFORMATION access to the calling token.","commonSituations":"Job object security descriptor denies write access. Group Policy restricting job limit modification. Running under a restricted token (e.g., AppContainer, sandboxed browser-like environment). EDR software blocking limit changes.","solutions":["Decode GetLastError() with 'net helpmsg <code>'.","Ensure the service account has SET_INFORMATION rights on the job object.","If running under a restricted token, escalate privileges or run as a service account with full job rights.","Catch the exception; the exec sandbox is defense-in-depth, not a hard requirement."],"exampleFix":"// before\nwindowsNativeAccess.tryInstallExecSandbox();\n\n// after\ntry {\n    windowsNativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n    logger.warn(\"Could not set Windows job object limits; exec sandbox not installed\", e);\n}","handlingStrategy":"try-catch","validationCode":"// No Java-level pre-check for SetInformationJobObject success.\n// Verify the account has job-object modification rights in Windows security policy.","typeGuard":null,"tryCatchPattern":"try {\n    nativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n    logger.warn(\"SetInformationJobObject failed; exec sandbox unavailable\", e);\n}","preventionTips":["Grant the Elasticsearch service account full job object rights.","Check Group Policy for job object restriction policies.","Treat sandbox installation as non-blocking."],"tags":["windows","native","security","sandbox","kernel32","job-object"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}