{"record":{"id":"26bcc6463d3551af","repo":"crowdsecurity/crowdsec","slug":"while-creating-system-well-known-sid-w","errorCode":null,"errorMessage":"while creating SYSTEM well known sid: %w","messagePattern":"while creating SYSTEM well known sid: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils_windows.go","lineNumber":63,"sourceCode":"}\n\ntype AccessAllowedAce struct {\n\tAceType    uint8\n\tAceFlags   uint8\n\tAceSize    uint16\n\tAccessMask uint32\n\tSidStart   uint32\n}\n\nconst ACCESS_ALLOWED_ACE_TYPE = 0\nconst ACCESS_DENIED_ACE_TYPE = 1\n\nfunc CheckPerms(path string) error {\n\tlog.Debugf(\"checking permissions of %s\\n\", path)\n\n\tsystemSid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinLocalSystemSid))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while creating SYSTEM well known sid: %w\", err)\n\t}\n\n\tadminSid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinBuiltinAdministratorsSid))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while creating built-in Administrators well known sid: %w\", err)\n\t}\n\n\tcurrentUser, err := user.Current()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting current user: %w\", err)\n\t}\n\n\tcurrentUserSid, _, _, err := windows.LookupSID(\"\", currentUser.Username)\n\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while looking up current user sid: %w\", err)\n\t}\n","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils_windows.go#L45-L81","documentation":"On Windows, CheckPerms builds the well-known SYSTEM SID via windows.CreateWellKnownSid(WinLocalSystemSid) as the first step of validating plugin ACLs. If that Win32-backed call fails, the error is wrapped with this message. This is an OS API failure, not a config problem, and would indicate a badly broken Windows security subsystem.","triggerScenarios":"CheckPerms (invoked from pluginIsValid on Windows builds) calls windows.CreateWellKnownSid for WinLocalSystemSid and the underlying API returns FALSE, producing a Windows error — effectively only when the process token or the OS security environment is corrupt.","commonSituations":"Running on a heavily restricted or non-genuine Windows environment; broken win32 API/token in a minimal or emulated Windows container; extremely rare in practice.","solutions":["Read the wrapped %w cause for the underlying Windows error code","Restart the machine / check the Windows security subsystem (lsass) health","If it occurs in a Windows container, verify the base image supports SID creation APIs and try a full Windows host"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := CheckPerms(path); err != nil {\n    var werr syscall.Errno\n    if errors.As(err, &werr) {\n        log.Fatalf(\"windows API failure creating SYSTEM SID (errno %d): %v\", werr, err)\n    }\n    return err\n}","preventionTips":["Run on a healthy, genuine Windows installation — this only fails when the security subsystem is broken","Check the wrapped error code for LSASS/token issues","Report upstream with the underlying Windows error if it persists"],"tags":["go","windows","security","sid"],"backgroundTag":"sid-creation-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}