{"record":{"id":"383936838edcb10c","repo":"sipeed/picoclaw","slug":"set-token-low-integrity-w","errorCode":null,"errorMessage":"set token low integrity: %w","messagePattern":"set token low integrity: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/isolation/platform_windows.go","lineNumber":205,"sourceCode":"// integrity locations are blocked by the OS.\nfunc setTokenLowIntegrity(token windows.Token) error {\n\tlowSID, err := windows.CreateWellKnownSid(windows.WinLowLabelSid)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create low integrity sid: %w\", err)\n\t}\n\ttml := windows.Tokenmandatorylabel{\n\t\tLabel: windows.SIDAndAttributes{\n\t\t\tSid:        lowSID,\n\t\t\tAttributes: windows.SE_GROUP_INTEGRITY,\n\t\t},\n\t}\n\tif err := windows.SetTokenInformation(\n\t\ttoken,\n\t\twindows.TokenIntegrityLevel,\n\t\t(*byte)(unsafe.Pointer(&tml)),\n\t\ttml.Size(),\n\t); err != nil {\n\t\treturn fmt.Errorf(\"set token low integrity: %w\", err)\n\t}\n\treturn nil\n}\n\n// formatWindowsAccessRules reshapes the internal rules for structured logging.\nfunc formatWindowsAccessRules(rules []AccessRule) []map[string]string {\n\tformatted := make([]map[string]string, 0, len(rules))\n\tfor _, rule := range rules {\n\t\tformatted = append(formatted, map[string]string{\n\t\t\t\"path\": rule.Path,\n\t\t\t\"mode\": rule.Mode,\n\t\t})\n\t}\n\treturn formatted\n}\n","sourceCodeStart":187,"sourceCodeEnd":221,"githubUrl":"https://github.com/sipeed/picoclaw/blob/49183d7e8daed0dba89ddbb6fcb60089401d9680/pkg/isolation/platform_windows.go#L187-L221","documentation":"Raised in setTokenLowIntegrity when windows.SetTokenInformation(token, TokenIntegrityLevel, &tml, tml.Size()) fails while lowering the duplicated token's integrity to Low. The Tokenmandatorylabel struct carries the low SID with SE_GROUP_INTEGRITY. Failure means Windows refused to apply the integrity label to the restricted token that will be assigned to the child.","triggerScenarios":"(1) The token handle lacks TOKEN_ADJUST_DEFAULT rights (the earlier OpenProcessToken/DuplicateTokenEx requested them, so this points at policy or handle tampering); (2) ERROR_INVALID_PARAMETER from a malformed label/size — not expected from this code path; (3) attempting to raise rather than lower integrity without privileges (not this path, which only lowers); (4) EDR/LSASS policy stripping label-modification rights from duplicated tokens.","commonSituations":"Hardened hosts or application-control software (CrowdStrike, AppLocker policies) that restrict token manipulation; running the parent under a heavily restricted service account whose token duplication drops adjust rights; broken Windows security baseline GPOs on the host.","solutions":["Unwrap the errno: ERROR_ACCESS_DENIED (5) means the token cannot be adjusted — check whether security software or group policy restricts SetTokenInformation","Confirm the parent process token is a normal user token (not already restricted/sandboxed) before enabling isolation","Add an exclusion for the process in the interfering EDR/AV, or disable isolation on that host","Verify the Windows image is genuine (sfc /scannow) if no policy explains the denial"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := launchIsolated(cmd); err != nil {\n    if strings.Contains(err.Error(), \"set token low integrity\") {\n        var errno syscall.Errno\n        if errors.As(err, &errno) && errno == windows.ERROR_ACCESS_DENIED {\n            // token adjustment blocked by policy/EDR: refuse unconfined execution\n            return fmt.Errorf(\"host policy blocks integrity changes (errno %d); disable isolation on this host\", errno)\n        }\n    }\n    return err\n}","preventionTips":["Run the parent under a normal, unmanaged user token; avoid enabling isolation from already-restricted service accounts","If EDR/LSASS policy intercepts SetTokenInformation, add an exclusion or disable isolation on that host","Treat any integrity-label failure as fatal — do not fall back to launching an unrestricted child"],"tags":["windows","isolation","security","token","win32"],"backgroundTag":null,"analyzedSha":"49183d7e8daed0dba89ddbb6fcb60089401d9680","analyzedAt":"2026-08-15T21:55:41.315Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}