{"record":{"id":"23419e4ef9b8dc06","repo":"crowdsecurity/crowdsec","slug":"while-creating-acl-w","errorCode":null,"errorMessage":"while creating ACL: %w","messagePattern":"while creating ACL: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/database/file_utils_windows.go","lineNumber":70,"sourceCode":"\t\t\t\t\tTrusteeType:              windows.TRUSTEE_IS_USER,\n\t\t\t\t\tTrusteeValue:             windows.TrusteeValueFromSID(currentOwner),\n\t\t\t\t},\n\t\t\t},\n\t\t\t{\n\t\t\t\tAccessPermissions: windows.GENERIC_ALL,\n\t\t\t\tAccessMode:        windows.GRANT_ACCESS,\n\t\t\t\tInheritance:       windows.NO_INHERITANCE,\n\t\t\t\tTrustee: windows.TRUSTEE{\n\t\t\t\t\tMultipleTrusteeOperation: windows.NO_MULTIPLE_TRUSTEE,\n\t\t\t\t\tTrusteeForm:              windows.TRUSTEE_IS_SID,\n\t\t\t\t\tTrusteeType:              windows.TRUSTEE_IS_GROUP,\n\t\t\t\t\tTrusteeValue:             windows.TrusteeValueFromSID(currentGroup),\n\t\t\t\t},\n\t\t\t},\n\t\t}, nil)\n\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while creating ACL: %w\", err)\n\t}\n\n\terr = windows.SetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.DACL_SECURITY_INFORMATION|windows.PROTECTED_DACL_SECURITY_INFORMATION, nil, nil, dacl, nil)\n\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while setting security info: %w\", err)\n\t}\n\treturn nil\n}\n","sourceCodeStart":52,"sourceCodeEnd":80,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/file_utils_windows.go#L52-L80","documentation":"setFilePerm on Windows failed while building the new DACL from the ACCESS_ALLOWED_ACE entries for owner and group via windows.ACLFromEntries. If the ACL object cannot be constructed, the restrictive permissions cannot be applied to the file.","triggerScenarios":"ACLFromEntries failing for the owner/group ACEs built from the previously resolved SIDs — e.g. invalid SID blob, ACE construction failure, or Win32 API error (ERROR_INVALID_SECURITY_DESCR / out of memory).","commonSituations":"Extremely rare; seen when previously-resolved SIDs are malformed (descriptor corruption) or under memory pressure in long-running services.","solutions":["Reset the file's security descriptor (`icacls <path> /reset`) so clean SIDs are re-read, then restart crowdsec.","Recreate the file/database on a local NTFS volume.","Check the wrapped Win32 error code for the precise API failure."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := setFilePerm(path, 0600)\nif err != nil {\n\tlog.Warnf(\"ACL build failed for %s: %v\", path, err)\n\t// check the wrapped Win32 error for the exact cause\n}","preventionTips":["Reset corrupted security descriptors with icacls /reset so SIDs are clean.","Recreate the database on the target volume instead of moving it across systems."],"tags":["windows","acl","dacl","permissions"],"backgroundTag":"permission-denied","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}