JuliusBrussee/caveman · error

sqlite parent %q has no security descriptor

Error message

sqlite parent %q has no security descriptor

What it means

Error "sqlite parent %q has no security descriptor" thrown in JuliusBrussee/caveman.

Source

Thrown at engine/ccr/sqlite_parent_security_windows.go:23

import (
	"fmt"
	"os"
	"unsafe"

	"golang.org/x/sys/windows"
)

func validateSQLiteParentSecurity(path string, _ os.FileInfo) error {
	descriptor, err := windows.GetNamedSecurityInfo(
		path,
		windows.SE_FILE_OBJECT,
		windows.DACL_SECURITY_INFORMATION,
	)
	if err != nil {
		return fmt.Errorf("inspect sqlite parent ACL %q: %w", path, err)
	}
	if descriptor == nil {
		return fmt.Errorf("sqlite parent %q has no security descriptor", path)
	}
	dacl, _, err := descriptor.DACL()
	if err != nil || dacl == nil {
		return fmt.Errorf("sqlite parent %q has no restrictive DACL", path)
	}
	broad, err := windowsACLGrantsBroadWrite(dacl)
	if err != nil {
		return fmt.Errorf("inspect sqlite parent ACL %q: %w", path, err)
	}
	if broad {
		return fmt.Errorf("sqlite parent %q grants broad Windows write access", path)
	}
	return nil
}

func windowsACLGrantsBroadWrite(dacl *windows.ACL) (bool, error) {
	broadSIDs := make([]*windows.SID, 0, 4)
	for _, sidType := range []windows.WELL_KNOWN_SID_TYPE{

View on GitHub (pinned to 27d5a3981a)

Solutions

1. Add a security descriptor to the sqlite parent directory.

When it happens

Trigger: Thrown at engine/ccr/sqlite_parent_security_windows.go:23 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/513a4f0b993d9662. Report an issue: GitHub.