{"record":{"id":"025c6fbc573cda32","repo":"hashicorp/nomad","slug":"unable-to-convert-groupid-to-uint32-s","errorCode":null,"errorMessage":"unable to convert groupid to uint32: %s","messagePattern":"unable to convert groupid to uint32: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/shared/executor/executor_unix.go","lineNumber":90,"sourceCode":"\n\tgids := make([]uint32, len(gidStrings))\n\tfor _, gidString := range gidStrings {\n\t\tu, err := strconv.ParseUint(gidString, 10, 32)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to convert user's group to uint32 %s: %v\", gidString, err)\n\t\t}\n\n\t\tgids = append(gids, uint32(u))\n\t}\n\n\t// Convert the uid and gid\n\tuid, err := strconv.ParseUint(u.Uid, 10, 32)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to convert userid to uint32: %w\", err)\n\t}\n\tgid, err := strconv.ParseUint(u.Gid, 10, 32)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to convert groupid to uint32: %s\", err)\n\t}\n\n\t// Set the command to run as that user and group.\n\tif cmd.SysProcAttr == nil {\n\t\tcmd.SysProcAttr = &syscall.SysProcAttr{}\n\t}\n\tif cmd.SysProcAttr.Credential == nil {\n\t\tcmd.SysProcAttr.Credential = &syscall.Credential{}\n\t}\n\tcmd.SysProcAttr.Credential.Uid = uint32(uid)\n\tcmd.SysProcAttr.Credential.Gid = uint32(gid)\n\tcmd.SysProcAttr.Credential.Groups = gids\n\n\t// Override USER, LOGNAME, and HOME environment variables.\n\tcmd.Env = append(cmd.Env, fmt.Sprintf(\"USER=%s\", u.Username))\n\tcmd.Env = append(cmd.Env, fmt.Sprintf(\"LOGNAME=%s\", u.Username))\n\tcmd.Env = append(cmd.Env, fmt.Sprintf(\"HOME=%s\", u.HomeDir))\n","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/shared/executor/executor_unix.go#L72-L108","documentation":"setCmdUser converts the resolved user's u.Gid string to uint32 for syscall.Credential. If the gid string from the user lookup is not parseable as a 32-bit unsigned integer, this error is returned (note: formatted with %s rather than %w, so it is not unwrappable).","triggerScenarios":"u.Gid returned by users.Lookup is empty, non-numeric, or exceeds uint32 — malformed passwd/group data from NSS/LDAP.","commonSituations":"LDAP gidNumber missing or malformed; hand-edited /etc/passwd with bad gid field; broken custom NSS module.","solutions":["Inspect 'getent passwd <userid>' and validate the gid field is numeric and < 4294967296.","Fix /etc/passwd or the LDAP gidNumber attribute for the user.","Re-create the user with a valid primary gid."],"exampleFix":"// before (/etc/passwd)\nappuser:x:1005:gid::/home/appuser:/bin/false\n// after\nappuser:x:1005:1005::/home/appuser:/bin/false","handlingStrategy":"validation","validationCode":"// Go: verify gid is numeric before launching\nu, err := user.Lookup(taskUser)\nif err != nil {\n    return err\n}\nif _, err := strconv.ParseUint(u.Gid, 10, 32); err != nil {\n    return fmt.Errorf(\"user %q has malformed gid %q\", taskUser, u.Gid)\n}","typeGuard":"func hasValidGid(u *user.User) bool {\n    _, err := strconv.ParseUint(u.Gid, 10, 32)\n    return err == nil\n}","tryCatchPattern":"if err := exec.SetUser(cmd, userid); err != nil {\n    if strings.Contains(err.Error(), \"groupid to uint32\") {\n        // passwd gid field corrupt: remediate user db\n    }\n    return err\n}","preventionTips":["Validate passwd entries with 'pwck' after provisioning.","Keep LDAP gidNumber attributes numeric and in range.","Run configuration drift checks against /etc/passwd."],"tags":["unix","gid","strconv","nomad-executor"],"backgroundTag":"invalid-numeric-id","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}