{"record":{"id":"3d9481697326a54b","repo":"AdguardTeam/AdGuardHome","slug":"setting-gid-w","errorCode":null,"errorMessage":"setting gid: %w","messagePattern":"setting gid: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/aghos/user_unix.go","lineNumber":25,"sourceCode":"\t\"os/user\"\n\t\"strconv\"\n\t\"syscall\"\n)\n\nfunc setGroup(groupName string) (err error) {\n\tg, err := user.LookupGroup(groupName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"looking up group: %w\", err)\n\t}\n\n\tgid, err := strconv.Atoi(g.Gid)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"parsing gid: %w\", err)\n\t}\n\n\terr = syscall.Setgid(gid)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"setting gid: %w\", err)\n\t}\n\n\treturn nil\n}\n\nfunc setUser(userName string) (err error) {\n\tu, err := user.Lookup(userName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"looking up user: %w\", err)\n\t}\n\n\tuid, err := strconv.Atoi(u.Uid)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"parsing uid: %w\", err)\n\t}\n\n\terr = syscall.Setuid(uid)\n\tif err != nil {","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/AdguardTeam/AdGuardHome/blob/b41aefbe51c8dde65e2c50f093996afa0502edf9/internal/aghos/user_unix.go#L7-L43","documentation":"The final step of setGroup: syscall.Setgid(gid) failed. Setgid requires root (or appropriate capabilities) and is one-shot — it typically fails with EPERM if the process isn't privileged, or EINVAL for an invalid gid.","triggerScenarios":"Running AdGuardHome as a non-root user while configuring a group: value in config; or running as root but inside a container missing CAP_SETGID; occasionally EINVAL from a negative or out-of-range gid.","commonSituations":"Systemd service running as DynamicUser/non-root without CAP_SETGID; Docker with dropped capabilities (--cap-drop=ALL); trying to change group after already dropping privileges.","solutions":["Run the service as root or a user with CAP_SETGID (systemd: AmbientCapabilities=CAP_SETGID or set User=root)","In Docker, retain the capability: --cap-add SETGID","Remove or comment out the group: setting if running unprivileged","Ensure setGroup runs before any privilege drop, not after"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// before starting unprivileged, check ability:\nif syscall.Geteuid() != 0 { /* skip or demand CAP_SETGID for group config */ }","typeGuard":null,"tryCatchPattern":"if err != nil && errors.Is(err, syscall.EPERM) { /* insufficient privilege: adjust service caps */ }","preventionTips":["Grant CAP_SETGID or run privileged when a group is configured","Perform setGroup before dropping other privileges","Drop capabilities in containers deliberately, keeping SETGID if needed"],"tags":["unix","setgid","eperm","privileges","syscall"],"backgroundTag":"setgid-permission-denied","analyzedSha":"b41aefbe51c8dde65e2c50f093996afa0502edf9","analyzedAt":"2026-08-27T04:57:55.097Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}