elastic/elasticsearch · error · UnsupportedOperationException

SetInformationJobObject: {}

Error message

SetInformationJobObject: {}

What it means

Thrown as UnsupportedOperationException when kernel32.SetInformationJobObject() returns false after querying the job's limits succeeded. The message includes GetLastError(). This means the process could create and read the job but was denied permission to modify its limits (specifically setting ActiveProcessLimit=1 and JOB_OBJECT_LIMIT_ACTIVE_PROCESS).

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/WindowsNativeAccess.java:173

    public void tryInstallExecSandbox() {
        // create a new Job
        Handle job = kernel.CreateJobObjectW();
        if (job == null) {
            throw new UnsupportedOperationException("CreateJobObject: " + kernel.GetLastError());
        }

        try {
            // retrieve the current basic limits of the job
            int clazz = JOBOBJECT_BASIC_LIMIT_INFORMATION_CLASS;
            var info = kernel.newJobObjectBasicLimitInformation();
            if (kernel.QueryInformationJobObject(job, clazz, info) == false) {
                throw new UnsupportedOperationException("QueryInformationJobObject: " + kernel.GetLastError());
            }
            // modify the number of active processes to be 1 (exactly the one process we will add to the job).
            info.setActiveProcessLimit(1);
            info.setLimitFlags(JOB_OBJECT_LIMIT_ACTIVE_PROCESS);
            if (kernel.SetInformationJobObject(job, clazz, info) == false) {
                throw new UnsupportedOperationException("SetInformationJobObject: " + kernel.GetLastError());
            }
            // assign ourselves to the job
            if (kernel.AssignProcessToJobObject(job, kernel.GetCurrentProcess()) == false) {
                throw new UnsupportedOperationException("AssignProcessToJobObject: " + kernel.GetLastError());
            }
        } finally {
            kernel.CloseHandle(job);
        }

        execSandboxState = ExecSandboxState.ALL_THREADS;
        logger.debug("Windows ActiveProcessLimit initialization successful");
    }

    @Override
    public OptionalLong allocatedSizeInBytes(Path path) {
        assert Files.isRegularFile(path) : path;
        String fileName = "\\\\?\\" + path;
        AtomicInteger lpFileSizeHigh = new AtomicInteger();

View on GitHub (pinned to db6a809a66)

Solutions

  1. Decode GetLastError() with 'net helpmsg <code>'.
  2. Ensure the service account has SET_INFORMATION rights on the job object.
  3. If running under a restricted token, escalate privileges or run as a service account with full job rights.
  4. Catch the exception; the exec sandbox is defense-in-depth, not a hard requirement.

Example fix

// before
windowsNativeAccess.tryInstallExecSandbox();

// after
try {
    windowsNativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("Could not set Windows job object limits; exec sandbox not installed", e);
}
Defensive patterns

Strategy: try-catch

Validate before calling

// No Java-level pre-check for SetInformationJobObject success.
// Verify the account has job-object modification rights in Windows security policy.

Try / catch

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("SetInformationJobObject failed; exec sandbox unavailable", e);
}

Prevention

When it happens

Trigger: Calling tryInstallExecSandbox() where SetInformationJobObject(job, JOBOBJECT_BASIC_LIMIT_INFORMATION, info) fails. The job handle's ACL denies SET_INFORMATION access to the calling token.

Common situations: Job object security descriptor denies write access. Group Policy restricting job limit modification. Running under a restricted token (e.g., AppContainer, sandboxed browser-like environment). EDR software blocking limit changes.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/c4887baa1ace4b6d. Report an issue: GitHub.