{"record":{"id":"38826f1d7d3b435f","repo":"JuliusBrussee/caveman","slug":"native-runtime-current-user-sid-w","errorCode":null,"errorMessage":"native runtime current user SID: %w","messagePattern":"native runtime current user SID: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/internal/nativeruntime/server_windows.go","lineNumber":43,"sourceCode":"\tnormalized := strings.ToLower(filepath.Clean(absolute))\n\tsum := sha256.Sum256([]byte(normalized))\n\treturn `\\\\.\\pipe\\caveman-native-` + hex.EncodeToString(sum[:8])\n}\n\nfunc dialNativeRuntime(ctx context.Context, home string) (net.Conn, error) {\n\treturn winio.DialPipeContext(ctx, SocketPath(home))\n}\n\n// Serve exposes the same bounded JSON protocol over a user-only Windows named\n// pipe. go-winio rejects remote clients at pipe creation; explicit owner SID\n// ACL prevents another local user from attaching.\nfunc Serve(ctx context.Context, home string, runtime *Runtime) error {\n\tif runtime == nil || runtime.store == nil {\n\t\treturn errors.New(\"native runtime: store is required\")\n\t}\n\tuser, err := windows.GetCurrentProcessToken().GetTokenUser()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"native runtime current user SID: %w\", err)\n\t}\n\tif user == nil || user.User.Sid == nil {\n\t\treturn errors.New(\"native runtime current user SID: unavailable\")\n\t}\n\tsddl := \"D:P(A;;GA;;;\" + user.User.Sid.String() + \")\"\n\tlistener, err := winio.ListenPipe(SocketPath(home), &winio.PipeConfig{\n\t\tSecurityDescriptor: sddl,\n\t\tInputBufferSize:    maxRequestBytes,\n\t\tOutputBufferSize:   maxRequestBytes,\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"native runtime named-pipe listen: %w\", err)\n\t}\n\tdefer listener.Close()\n\tgo func() {\n\t\t<-ctx.Done()\n\t\t_ = listener.Close()\n\t}()","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/proxy/internal/nativeruntime/server_windows.go#L25-L61","documentation":"Returned when the Windows build of the native runtime cannot read the current process token's user via windows.GetCurrentProcessToken().GetTokenUser(). The SID is required to build the SDDL owner-only ACL on the named pipe, so a failure here aborts Serve before any pipe is created.","triggerScenarios":"Calling nativeruntime.Serve on Windows when the Win32 API fails to open or query the process token — e.g. restricted tokens under some service contexts, sandboxed processes, or broken privilege-removal in the parent.","commonSituations":"Running caveman under a heavily restricted service account or job object; Windows sandbox (AppContainer/low integrity) stripping token query rights; unusual terminal-session environments (SSH-into-Windows session 0 quirks) where the token API behaves differently. The adjacent 'SID: unavailable' string fires when the call succeeds but returns a nil user/SID.","solutions":["Run the process under a normal interactive or standard service account rather than a sandboxed/restricted token","If running under a custom service wrapper, ensure it does not strip TOKEN_QUERY from the process token","Verify with a minimal Go program calling windows.GetCurrentProcessToken().GetTokenUser() to isolate environment vs. code issues","Update go-winio / x/sys/windows — token enumeration has had fixes across Windows versions"],"exampleFix":"// before: service launcher applies a restricted token, GetTokenUser fails\nerr := nativeruntime.Serve(ctx, home, rt)\n\n// after: launch without token restriction (normal service account)\n// then:\nerr := nativeruntime.Serve(ctx, home, rt)","handlingStrategy":"try-catch","validationCode":"null","typeGuard":null,"tryCatchPattern":"if err := nativeruntime.Serve(ctx, home, rt); err != nil {\n    if strings.Contains(err.Error(), \"current user SID\") {\n        // environment/token problem, not a code bug: rerun under a normal user token\n        log.Error(\"cannot query process token; run under an unrestricted user account\", \"error\", err)\n    }\n}","preventionTips":["Test the exact Windows service/session context before deploying","Avoid launching caveman from sandboxed parents (AppContainer, restricted tokens)","Keep x/sys/windows and go-winio current"],"tags":["windows","named-pipe","security-token","nativeruntime"],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}