{"record":{"id":"35ac7950c6542aa7","repo":"crowdsecurity/crowdsec","slug":"unable-to-set-perms-on-s-w","errorCode":null,"errorMessage":"unable to set perms on %s: %w","messagePattern":"unable to set perms on (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/database/database.go","lineNumber":94,"sourceCode":"\tif err != nil {\n\t\treturn nil, err // unsupported database caught here\n\t}\n\n\tif config.Type == \"sqlite\" && config.DbPath != \":memory:\" {\n\t\t/*if it's the first startup, we want to touch and chmod file*/\n\t\tif _, err = os.Stat(config.DbPath); os.IsNotExist(err) {\n\t\t\tf, err := os.OpenFile(config.DbPath, os.O_CREATE|os.O_RDWR, 0o600)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to create SQLite database file %q: %w\", config.DbPath, err)\n\t\t\t}\n\n\t\t\tif err := f.Close(); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to create SQLite database file %q: %w\", config.DbPath, err)\n\t\t\t}\n\t\t}\n\t\t// Always try to set permissions to simplify a bit the code for windows (as the permissions set by OpenFile will be garbage)\n\t\tif err = setFilePerm(config.DbPath, 0o640); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to set perms on %s: %w\", config.DbPath, err)\n\t\t}\n\t}\n\n\tdbConnectionString, err := config.ConnectionString()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to generate DB connection string: %w\", err)\n\t}\n\n\tdrv, err := getEntDriver(typ, dia, dbConnectionString, config)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed opening connection to %s: %w\", config.Type, err)\n\t}\n\n\tclient = ent.NewClient(ent.Driver(drv), entOpt)\n\n\tif config.LogLevel >= log.DebugLevel {\n\t\tlogger.Debugf(\"Enabling request debug\")\n","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/database.go#L76-L112","documentation":"After creating the SQLite file, NewClient calls setFilePerm(db_path, 0640) and wraps any failure as `unable to set perms on <path>`. On Unix this is os.Chmod/chown-style enforcement; on Windows permission semantics differ, which is why the code always attempts it. Startup aborts on failure.","triggerScenarios":"chmod fails because the process doesn't own the file (created previously by root, now running as the crowdsec user), read-only filesystem, or unsupported/failed permission operation on exotic filesystems (Windows ACLs, FUSE).","commonSituations":"First run executed with sudo and later runs as service user who can't chmod a root-owned file; Docker volume with mismatched UID; immutable flag set on the file.","solutions":["chown the database file and its directory to the user crowdsec runs as (sudo chown crowdsec:crowdsec /var/lib/crowdsec/data/crowdsec.db)","Remove immutable attributes (chattr -i) or move the data dir off restricted filesystems","Delete the pre-existing file (backup first) so it's recreated by the correct user","Check mount options (read-only) and MAC-policy denials"],"exampleFix":"// before\n-rw------- root root /var/lib/crowdsec/data/crowdsec.db   # created by sudo run\n// after\nsudo chown crowdsec:crowdsec /var/lib/crowdsec/data/crowdsec.db\nsudo chmod 640 /var/lib/crowdsec/data/crowdsec.db","handlingStrategy":"validation","validationCode":"info, err := os.Stat(dbPath)\nif err == nil && info.Mode().Perm()&0o200 == 0 {\n\tlog.Fatalf(\"db file not writable by %s\", os.Geteuid())\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always run crowdsec as one consistent user; avoid mixing sudo and service runs","Pre-set 0640 ownership/permissions in packaging/postinst","Check for immutable flags or read-only mounts on the data dir","On Windows, verify ACLs on the data directory"],"tags":["sqlite","permissions","chmod","startup"],"backgroundTag":"permission-denied","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}