JuliusBrussee/caveman · error

sqlite parent %q grants broad Windows write access

Error message

sqlite parent %q grants broad Windows write access

What it means

Error "sqlite parent %q grants broad Windows write access" thrown in JuliusBrussee/caveman.

Source

Thrown at engine/ccr/sqlite_parent_security_windows.go:34

		windows.SE_FILE_OBJECT,
		windows.DACL_SECURITY_INFORMATION,
	)
	if err != nil {
		return fmt.Errorf("inspect sqlite parent ACL %q: %w", path, err)
	}
	if descriptor == nil {
		return fmt.Errorf("sqlite parent %q has no security descriptor", path)
	}
	dacl, _, err := descriptor.DACL()
	if err != nil || dacl == nil {
		return fmt.Errorf("sqlite parent %q has no restrictive DACL", path)
	}
	broad, err := windowsACLGrantsBroadWrite(dacl)
	if err != nil {
		return fmt.Errorf("inspect sqlite parent ACL %q: %w", path, err)
	}
	if broad {
		return fmt.Errorf("sqlite parent %q grants broad Windows write access", path)
	}
	return nil
}

func windowsACLGrantsBroadWrite(dacl *windows.ACL) (bool, error) {
	broadSIDs := make([]*windows.SID, 0, 4)
	for _, sidType := range []windows.WELL_KNOWN_SID_TYPE{
		windows.WinWorldSid,
		windows.WinAuthenticatedUserSid,
		windows.WinBuiltinUsersSid,
		windows.WinBuiltinGuestsSid,
	} {
		sid, err := windows.CreateWellKnownSid(sidType)
		if err != nil {
			return false, err
		}
		broadSIDs = append(broadSIDs, sid)
	}

View on GitHub (pinned to 27d5a3981a)

Solutions

1. Remove broad write access grants from the sqlite parent directory.

When it happens

Trigger: Thrown at engine/ccr/sqlite_parent_security_windows.go:34 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/6e851f5646450cf4. Report an issue: GitHub.