{"record":{"id":"50a15a8747357bbf","repo":"hashicorp/nomad","slug":"validator-w","errorCode":null,"errorMessage":"validator: %w","messagePattern":"validator: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/shared/validators/validators.go","lineNumber":77,"sourceCode":"\t\tdeniedUIDs: idset.Parse[UserID](deniedHostUIDs),\n\t\tdeniedGIDs: idset.Parse[GroupID](deniedHostGIDs),\n\t\tlogger:     valLogger,\n\t}\n\n\treturn v, nil\n}\n\n// HasValidIDs is used when running a task to ensure the\n// given user is in the ID range defined in the task config\nfunc (v *Validator) HasValidIDs(userName string) error {\n\tuser, err := users.Lookup(userName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to identify user %q: %w\", userName, err)\n\t}\n\n\tuid, err := getUserID(user)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"validator: %w\", err)\n\t}\n\n\t// check uids\n\tif v.deniedUIDs.Contains(uid) {\n\t\treturn fmt.Errorf(\"running as uid %d is disallowed\", uid)\n\t}\n\n\tgids, err := getGroupsID(user)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"validator:  %w\", err)\n\t}\n\n\t// check gids\n\tfor _, gid := range gids {\n\t\tif v.deniedGIDs.Contains(gid) {\n\t\t\treturn fmt.Errorf(\"running as gid %d is disallowed\", gid)\n\t\t}\n\t}","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/shared/validators/validators.go#L59-L95","documentation":"After resolving the user, HasValidIDs extracts the numeric UID via getUserID. This error means the passwd entry's UID field could not be parsed into a number (strconv.Atoi failure) — the user record on the host is malformed. The generic \"validator:\" prefix wraps the low-level parse error.","triggerScenarios":"users.Lookup returned a user whose Uid string is non-numeric (corrupt or hand-edited /etc/passwd, or unusual NSS backends returning malformed records), during task validation on the client.","commonSituations":"Manually edited /etc/passwd with a non-numeric UID field; broken custom NSS modules; containerized/chroot environments with mangled passwd files; SELinux or provisioning tools writing invalid entries.","solutions":["Inspect the user's passwd entry (getent passwd <user>) and fix a non-numeric UID field","Delete and recreate the user with a valid numeric UID","Audit provisioning tools/templates that generate /etc/passwd for format errors","Check alternate NSS sources (LDAP) are returning RFC-compliant records"],"exampleFix":"// before (corrupt /etc/passwd entry)\nappuser:x:abc:1500::/home/appuser:/bin/bash\n// after\nappuser:x:1500:1500::/home/appuser:/bin/bash","handlingStrategy":"validation","validationCode":"u, err := user.Lookup(userName)\nif err != nil { return err }\nif _, err := strconv.Atoi(u.Uid); err != nil {\n    return fmt.Errorf(\"user %q has malformed UID %q in passwd database\", userName, u.Uid)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never hand-edit /etc/passwd — use useradd/usermod","Alert on passwd database drift with config audits","Validate NSS sources return RFC-compliant records"],"tags":["user-lookup","uid","validation","os-users"],"backgroundTag":"invalid-uid","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}