{"record":{"id":"18d99c75f1c1a148","repo":"crowdsecurity/crowdsec","slug":"while-setting-security-info-w","errorCode":null,"errorMessage":"while setting security info: %w","messagePattern":"while setting security info: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/database/file_utils_windows.go","lineNumber":76,"sourceCode":"\t\t\t\tAccessMode:        windows.GRANT_ACCESS,\n\t\t\t\tInheritance:       windows.NO_INHERITANCE,\n\t\t\t\tTrustee: windows.TRUSTEE{\n\t\t\t\t\tMultipleTrusteeOperation: windows.NO_MULTIPLE_TRUSTEE,\n\t\t\t\t\tTrusteeForm:              windows.TRUSTEE_IS_SID,\n\t\t\t\t\tTrusteeType:              windows.TRUSTEE_IS_GROUP,\n\t\t\t\t\tTrusteeValue:             windows.TrusteeValueFromSID(currentGroup),\n\t\t\t\t},\n\t\t\t},\n\t\t}, nil)\n\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while creating ACL: %w\", err)\n\t}\n\n\terr = windows.SetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.DACL_SECURITY_INFORMATION|windows.PROTECTED_DACL_SECURITY_INFORMATION, nil, nil, dacl, nil)\n\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while setting security info: %w\", err)\n\t}\n\treturn nil\n}\n","sourceCodeStart":58,"sourceCodeEnd":80,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/file_utils_windows.go#L58-L80","documentation":"setFilePerm on Windows failed at the final step: windows.SetNamedSecurityInfo could not write the new (protected) DACL onto the file. The ACL was built successfully but applying it was rejected by the OS, so the file keeps its old permissions.","triggerScenarios":"SetNamedSecurityInfo returning a Win32 error (commonly ERROR_ACCESS_DENIED) when writing DACL_SECURITY_INFORMATION|PROTECTED_DACL_SECURITY_INFORMATION — the running account lacks WRITE_DAC/ownership rights on the file, or the file was locked/removed.","commonSituations":"CrowdSec service account not owning the DB file (created earlier by an admin or another account); files on volumes where the account lacks WRITE_DAC; backup software holding the file open with exclusive locks.","solutions":["Ensure the crowdsec service account owns the file: `takeown /f <path>` then `icacls <path> /grant crowdsec:F`.","Run the service under an account with WRITE_DAC on the data directory (LocalSystem or a dedicated account given full control via icacls).","Check no backup/AV process holds the file exclusively; retry after restarting crowdsec."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Go (Windows): ensure the current process can write the DACL\n// (run icacls check or attempt takeown before calling the API)\ncmd := exec.Command(\"icacls\", path)\nif out, err := cmd.CombinedOutput(); err != nil {\n\tlog.Warnf(\"cannot inspect ACLs on %s: %v (%s)\", path, err, out)\n}","typeGuard":null,"tryCatchPattern":"err := setFilePerm(path, 0600)\nif err != nil {\n\tif strings.Contains(err.Error(), \"Access is denied\") {\n\t\t// take ownership or fix service account before retrying\n\t}\n\tlog.Warnf(\"setting security info failed: %v\", err)\n}","preventionTips":["Run the crowdsec service under the account that owns the data files.","Grant the service account Full control on the data directory via icacls.","Avoid creating DB files as administrator then running the service as another account."],"tags":["windows","acl","setsecurity","permissions"],"backgroundTag":"permission-denied","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}