{"record":{"id":"08f38e0439252ee3","repo":"puppetlabs/puppet","slug":"failed-to-set-security-information","errorCode":null,"errorMessage":"Failed to set security information","messagePattern":"Failed to set security information","errorType":"exception","errorClass":"Puppet::Util::Windows::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/security.rb","lineNumber":684,"sourceCode":"                    raise \"We should never get here\"\n                    # TODO: this should have been a warning in an earlier commit\n                  end\n                end\n\n                # protected means the object does not inherit aces from its parent\n                flags = OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION\n                flags |= sd.protect ? PROTECTED_DACL_SECURITY_INFORMATION : UNPROTECTED_DACL_SECURITY_INFORMATION\n\n                rv = SetSecurityInfo(handle,\n                                     :SE_FILE_OBJECT,\n                                     flags,\n                                     owner_sid_ptr,\n                                     group_sid_ptr,\n                                     acl_ptr,\n                                     FFI::MemoryPointer::NULL)\n\n                if rv != FFI::ERROR_SUCCESS\n                  raise Puppet::Util::Windows::Error, _(\"Failed to set security information\")\n                end\n              end\n            end\n          end\n        end\n      end\n    end\n  end\n\n  ffi_convention :stdcall\n\n  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa363858(v=vs.85).aspx\n  # HANDLE WINAPI CreateFile(\n  #   _In_      LPCTSTR lpFileName,\n  #   _In_      DWORD dwDesiredAccess,\n  #   _In_      DWORD dwShareMode,\n  #   _In_opt_  LPSECURITY_ATTRIBUTES lpSecurityAttributes,\n  #   _In_      DWORD dwCreationDisposition,","sourceCodeStart":666,"sourceCodeEnd":702,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/security.rb#L666-L702","documentation":"Raised when SetSecurityInfo returns a non-success code while writing owner, group, and DACL to a file handle opened with READ_CONTROL|WRITE_DAC|WRITE_OWNER. Common Win32 reasons folded into this one message are access denied (ERROR_ACCESS_DENIED, no WRITE_DAC on the object), an owner/group the caller may not assign, or an invalid ACL/SID in the payload. The appended Win32 text from Puppet::Util::Windows::Error gives the exact reason.","triggerScenarios":"set_security_descriptor where the agent lacks WRITE_DAC/WRITE_OWNER on the target, where the new owner SID belongs to another principal without SE_RESTORE/SE_TAKE_OWNERSHIP held, where a SID in the DACL failed validation, or where the protect flag combination (PROTECTED vs UNPROTECTED DACL) conflicted with inheritance.","commonSituations":"Managing owner/group on files owned by Administrators/TrustedInstaller while running non-elevated; manifests setting owner to a different user than the agent runs as (Windows only allows assigning yourself, or anyone with restore privilege); system directories that resist DACL writes.","solutions":["Read e.code / appended message: 5 = access denied, 1307 = invalid owner","Run elevated; only then can owner be set to arbitrary SIDs via SE_RESTORE_NAME/SE_TAKE_OWNERSHIP","Grant the agent account WRITE_DAC on the subtree (or take ownership once) before managing ACLs there","Verify every SID in the new descriptor with Puppet::Util::Windows::SID.valid_sid? before applying"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"unless Puppet::Util::Windows::SID.valid_sid?(sd.owner) && Puppet::Util::Windows::SID.valid_sid?(sd.group)\n  raise Puppet::Error, 'owner/group must be valid S-1-x-y SID strings'\nend\n# setting owner to another principal requires elevation (SeRestore/SeTakeOwnership)","typeGuard":null,"tryCatchPattern":"begin\n  Puppet::Util::Windows::Security.set_security_descriptor(path, sd)\nrescue Puppet::Util::Windows::Error => e\n  raise Puppet::Error, \"No WRITE_DAC on #{path}; elevate or grant rights\" if e.code == 5\n  raise Puppet::Error, \"Owner #{sd.owner} not assignable by this token; elevate\" if e.code == 1307\n  raise\nend","preventionTips":["Only set owner/group to other principals from an elevated process","Grant the agent WRITE_DAC on target subtrees once, before managing ACLs there","Validate all SIDs in the descriptor before the write; check e.code (5 access denied, 1307 invalid owner) on failure"],"tags":["windows","security","win32","acl","access-denied","setsecurityinfo"],"backgroundTag":"windows-security-descriptor-write-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}