{"record":{"id":"52ecebe65a4ef574","repo":"crowdsecurity/crowdsec","slug":"while-creating-s-w","errorCode":null,"errorMessage":"while creating %s: %w","messagePattern":"while creating (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cwhub/fetch.go","lineNumber":36,"sourceCode":"// If the content is base64 encoded, it will be decoded before writing. Call this method only\n// if item.Content if not empty.\nfunc (i *Item) writeEmbeddedContentTo(destPath, wantHash string) error {\n\tif i.Content == \"\" {\n\t\treturn fmt.Errorf(\"no embedded content for %s\", i.Name)\n\t}\n\n\tcontent, err := base64.StdEncoding.DecodeString(i.Content)\n\tif err != nil {\n\t\tcontent = []byte(i.Content)\n\t}\n\n\tdir := filepath.Dir(destPath)\n\treader := bytes.NewReader(content)\n\thash := crypto.SHA256.New()\n\n\ttee := io.TeeReader(reader, hash)\n\tif err := os.MkdirAll(dir, 0o755); err != nil {\n\t\treturn fmt.Errorf(\"while creating %s: %w\", dir, err)\n\t}\n\n\tf, err := os.OpenFile(destPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o600)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tdefer f.Close()\n\n\tif _, err := io.Copy(f, tee); err != nil {\n\t\treturn err\n\t}\n\n\tgotHash := hex.EncodeToString(hash.Sum(nil))\n\tif gotHash != wantHash {\n\t\treturn fmt.Errorf(\"%w. The index file is invalid, please run 'cscli hub update' and try again\",\n\t\t\tdownloader.HashMismatchError{\n\t\t\t\tExpected: wantHash,","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/cwhub/fetch.go#L18-L54","documentation":"writeEmbeddedContentTo fails while creating the parent directory of destPath via os.MkdirAll before writing the embedded content. The wrapped os error indicates why the directory could not be created (permissions, path is a file, full disk).","triggerScenarios":"Fetching content for an item whose destination directory does not exist and cannot be created — e.g. /etc/crowdsec/<type> missing with root-only parent dirs, or a path component being a regular file.","commonSituations":"Running cscli/crowdsec without sufficient privileges, a file existing where a directory is expected, read-only filesystem, or SELinux/AppArmor restrictions on /etc/crowdsec or /var/lib/crowdsec.","solutions":["Run the command with appropriate privileges (sudo)","Check that no regular file exists at the directory path: `ls -la` the parent path","Verify filesystem is writable and not full: `df -h`, `mount -o remount,rw ...`","Check SELinux/AppArmor denials in audit logs"],"exampleFix":"// before\ncscli hub update   # as unprivileged user\n// after\nsudo cscli hub update","handlingStrategy":"try-catch","validationCode":"dir := filepath.Dir(destPath)\nif st, err := os.Stat(dir); err == nil && !st.IsDir() {\n    return fmt.Errorf(\"%s exists and is not a directory\", dir)\n}\nif err := os.MkdirAll(dir, 0o755); err != nil {\n    return err // surface early with full context\n}","typeGuard":null,"tryCatchPattern":"if err := item.FetchContentTo(ctx, provider, dest); err != nil {\n    var pe *os.PathError\n    if errors.As(err, &pe) {\n        logger.Errorf(\"filesystem error on %s: %v (check permissions/disk)\", pe.Path, pe.Err)\n        return\n    }\n    return err\n}","preventionTips":["Run hub operations with the privileges required for /etc/crowdsec and /var/lib/crowdsec","Ensure no regular file occupies a path that must be a directory","Monitor disk space and filesystem mount state","Check SELinux/AppAudit policies when on hardened systems"],"tags":["filesystem","permissions","mkdir","hub"],"backgroundTag":"mkdir-permission-denied","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}