{"record":{"id":"2f1cbca6330961ba","repo":"sipeed/picoclaw","slug":"create-low-integrity-sid-w","errorCode":null,"errorMessage":"create low integrity sid: %w","messagePattern":"create low integrity sid: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/isolation/platform_windows.go","lineNumber":191,"sourceCode":"\tif r1 == 0 {\n\t\tif e1 != nil && e1 != syscall.Errno(0) {\n\t\t\treturn 0, e1\n\t\t}\n\t\treturn 0, syscall.EINVAL\n\t}\n\tif err := setTokenLowIntegrity(restricted); err != nil {\n\t\t_ = restricted.Close()\n\t\treturn 0, err\n\t}\n\treturn restricted, nil\n}\n\n// setTokenLowIntegrity lowers the token integrity level so writes to higher\n// integrity locations are blocked by the OS.\nfunc setTokenLowIntegrity(token windows.Token) error {\n\tlowSID, err := windows.CreateWellKnownSid(windows.WinLowLabelSid)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create low integrity sid: %w\", err)\n\t}\n\ttml := windows.Tokenmandatorylabel{\n\t\tLabel: windows.SIDAndAttributes{\n\t\t\tSid:        lowSID,\n\t\t\tAttributes: windows.SE_GROUP_INTEGRITY,\n\t\t},\n\t}\n\tif err := windows.SetTokenInformation(\n\t\ttoken,\n\t\twindows.TokenIntegrityLevel,\n\t\t(*byte)(unsafe.Pointer(&tml)),\n\t\ttml.Size(),\n\t); err != nil {\n\t\treturn fmt.Errorf(\"set token low integrity: %w\", err)\n\t}\n\treturn nil\n}\n","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/sipeed/picoclaw/blob/49183d7e8daed0dba89ddbb6fcb60089401d9680/pkg/isolation/platform_windows.go#L173-L209","documentation":"Raised in createRestrictedPrimaryToken → setTokenLowIntegrity while building a low-integrity token for the isolated child. windows.CreateWellKnownSid(WinLowLabelSid) constructs the well-known S-1-16-4096 SID that is later attached as the token's mandatory integrity label. This call failing means Windows refused to allocate or initialize that well-known SID, so the restricted token cannot be produced.","triggerScenarios":"AllocateAndInitializeSid returning an error for WinLowLabelSid: essentially only on Windows editions/implementations that do not implement the mandatory-integrity SID family (pre-Vista lineage, Wine/ReactOS-style emulations), or genuine out-of-memory (ERROR_NOT_ENOUGH_MEMORY). On any supported Vista+ Windows this call practically never fails.","commonSituations":"Running the Windows isolation backend under Wine or an incomplete Windows compatibility layer; extremely old or stripped-down Windows builds; test hosts that emulate Windows APIs. Almost never seen on real Windows 10/11.","solutions":["Check the wrapped errno: ERROR_INVALID_PARAMETER indicates the platform does not support the WinLowLabelSid well-known SID","Run the process on a genuine, supported Windows build (Vista or later, realistically Windows 10/11)","If the host is a compatibility layer (Wine etc.), disable subprocess isolation there since integrity levels are not emulated"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := isolation.Preflight(); err != nil {\n    if strings.Contains(err.Error(), \"create low integrity sid\") {\n        // platform cannot build integrity SIDs (emulated/stripped windows) — isolation is unusable here\n        return fmt.Errorf(\"host windows build lacks integrity-level support; disable isolation: %w\", err)\n    }\n    return err\n}","preventionTips":["Run isolated children only on genuine supported Windows builds, not Wine/compat layers","Smoke-test isolation (start one enabled child) when deploying to a new Windows image"],"tags":["windows","isolation","security","sid","win32"],"backgroundTag":null,"analyzedSha":"49183d7e8daed0dba89ddbb6fcb60089401d9680","analyzedAt":"2026-08-15T21:55:41.315Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}