elastic/elasticsearch · error · UnsupportedOperationException

CreateJobObject: {}

Error message

CreateJobObject: {}

What it means

Thrown as UnsupportedOperationException from tryInstallExecSandbox() when kernel32.CreateJobObjectW() returns a null handle. The message includes the GetLastError() numeric code. This blocks installation of the Windows exec sandbox (ActiveProcessLimit=1) that prevents the Elasticsearch process from spawning arbitrary child processes as a defense-in-depth measure.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/WindowsNativeAccess.java:159

            isMemoryLocked = true;
        }
        // note: no need to close the process handle because GetCurrentProcess returns a pseudo handle
    }

    /**
     * Install exec system call filtering on Windows.
     * <p>
     * Process creation is restricted with {@code SetInformationJobObject/ActiveProcessLimit}.
     * <p>
     * Note: This is not intended as a real sandbox. It is another level of security, mostly intended to annoy
     * security researchers and make their lives more difficult in achieving "remote execution" exploits.
     */
    @Override
    public void tryInstallExecSandbox() {
        // create a new Job
        Handle job = kernel.CreateJobObjectW();
        if (job == null) {
            throw new UnsupportedOperationException("CreateJobObject: " + kernel.GetLastError());
        }

        try {
            // retrieve the current basic limits of the job
            int clazz = JOBOBJECT_BASIC_LIMIT_INFORMATION_CLASS;
            var info = kernel.newJobObjectBasicLimitInformation();
            if (kernel.QueryInformationJobObject(job, clazz, info) == false) {
                throw new UnsupportedOperationException("QueryInformationJobObject: " + kernel.GetLastError());
            }
            // modify the number of active processes to be 1 (exactly the one process we will add to the job).
            info.setActiveProcessLimit(1);
            info.setLimitFlags(JOB_OBJECT_LIMIT_ACTIVE_PROCESS);
            if (kernel.SetInformationJobObject(job, clazz, info) == false) {
                throw new UnsupportedOperationException("SetInformationJobObject: " + kernel.GetLastError());
            }
            // assign ourselves to the job
            if (kernel.AssignProcessToJobObject(job, kernel.GetCurrentProcess()) == false) {
                throw new UnsupportedOperationException("AssignProcessToJobObject: " + kernel.GetLastError());

View on GitHub (pinned to db6a809a66)

Solutions

  1. Decode the error code: run 'net helpmsg <code>' in cmd to get the Windows error description.
  2. Ensure the Elasticsearch service account has sufficient privileges to create job objects.
  3. If running in a container or nested sandbox, this is expected; the exec sandbox is best-effort.
  4. Consult Windows event logs for security audit entries related to privilege use.

Example fix

// before: unguarded sandbox installation
windowsNativeAccess.tryInstallExecSandbox();

// after: best-effort with fallback
try {
    windowsNativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("Could not install Windows exec sandbox; continuing without it", e);
}
Defensive patterns

Strategy: try-catch

Validate before calling

// On Windows, check OS before attempting sandbox installation.
// No pure Java pre-check for CreateJobObjectW availability; use try-catch.
if (!System.getProperty("os.name").toLowerCase().contains("windows")) {
    return; // sandbox is Windows-only
}

Try / catch

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("Windows exec sandbox installation failed; process runs without ActiveProcessLimit restriction", e);
}

Prevention

When it happens

Trigger: Calling tryInstallExecSandbox() on Windows when the process lacks the privilege to create a job object, or under resource exhaustion. CreateJobObjectW returns NULL and GetLastError reports the denial code.

Common situations: Running under a restricted service account without SeAssignPrimaryTokenPrivilege. Windows resource quota exhaustion (handle table full). Group Policy disallowing job object creation. Running in a nested container/sandbox that already restricts job creation.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/3d1de7015ab42665. Report an issue: GitHub.