{"record":{"id":"53548b0a70ac887b","repo":"puppetlabs/puppet","slug":"failed-to-get-security-information","errorCode":null,"errorMessage":"Failed to get security information","messagePattern":"Failed to get security information","errorType":"exception","errorClass":"Puppet::Util::Windows::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/security.rb","lineNumber":602,"sourceCode":"    sd = nil\n\n    with_privilege(SE_BACKUP_NAME) do\n      open_file(path, READ_CONTROL) do |handle|\n        FFI::MemoryPointer.new(:pointer, 1) do |owner_sid_ptr_ptr|\n          FFI::MemoryPointer.new(:pointer, 1) do |group_sid_ptr_ptr|\n            FFI::MemoryPointer.new(:pointer, 1) do |dacl_ptr_ptr|\n              FFI::MemoryPointer.new(:pointer, 1) do |sd_ptr_ptr|\n                rv = GetSecurityInfo(\n                  handle,\n                  :SE_FILE_OBJECT,\n                  OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,\n                  owner_sid_ptr_ptr,\n                  group_sid_ptr_ptr,\n                  dacl_ptr_ptr,\n                  FFI::Pointer::NULL, # sacl\n                  sd_ptr_ptr\n                ) # sec desc\n                raise Puppet::Util::Windows::Error, _(\"Failed to get security information\") if rv != FFI::ERROR_SUCCESS\n\n                # these 2 convenience params are not freed since they point inside sd_ptr\n                owner = Puppet::Util::Windows::SID.sid_ptr_to_string(owner_sid_ptr_ptr.get_pointer(0))\n                group = Puppet::Util::Windows::SID.sid_ptr_to_string(group_sid_ptr_ptr.get_pointer(0))\n\n                FFI::MemoryPointer.new(:word, 1) do |control|\n                  FFI::MemoryPointer.new(:dword, 1) do |revision|\n                    sd_ptr_ptr.read_win32_local_pointer do |sd_ptr|\n                      if GetSecurityDescriptorControl(sd_ptr, control, revision) == FFI::WIN32_FALSE\n                        raise Puppet::Util::Windows::Error, _(\"Failed to get security descriptor control\")\n                      end\n\n                      protect = (control.read_word & SE_DACL_PROTECTED) == SE_DACL_PROTECTED\n                      dacl = parse_dacl(dacl_ptr_ptr.get_pointer(0))\n                      sd = Puppet::Util::Windows::SecurityDescriptor.new(owner, group, dacl, protect)\n                    end\n                  end\n                end","sourceCodeStart":584,"sourceCodeEnd":620,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/security.rb#L584-L620","documentation":"Raised when GetSecurityInfo returns anything other than ERROR_SUCCESS while reading owner, group, and DACL from a file handle. The handle was opened by open_file, so failure typically means the caller lacked READ_CONTROL on the object or the object type could not supply the requested information. The appended Win32 text identifies the exact cause.","triggerScenarios":"get_security_descriptor where the open_file handle lacks READ_CONTROL (opened with WRITE-only rights), reading security on system objects (e.g. under C:\\Windows\\System32) as a non-admin, or querying objects whose security information is not retrievable through the SE_FILE_OBJECT path.","commonSituations":"Agent running with insufficient rights over system directories; files owned by TrustedInstaller; manifests targeting OS-protected paths; handles opened on volumes/reparse points that do not support the requested information class.","solutions":["Read the appended Win32 message / e.code (5 = access denied is most common)","Run elevated or grant the agent account READ_CONTROL on the target subtree (icacls <path> /grant \"r\")","Skip managing security on OS-protected paths, or take ownership first","Confirm the path is a filesystem object Puppet can open (not a device or pipe)"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"begin\n  Puppet::Util::Windows::Security.get_security_descriptor(path)\nrescue Puppet::Util::Windows::Error => e\n  raise Puppet::Error, \"Cannot read security on #{path} (code #{e.code}); elevate or grant READ_CONTROL\" if e.code == 5\n  raise\nend","preventionTips":["Reserve ACL management on OS-protected paths for elevated runs","Test with a plain read of the target's ACL via icacls first to confirm rights","Branch on e.code so access-denied prompts an elevation fix rather than a retry"],"tags":["windows","security","win32","access-denied","security-descriptor"],"backgroundTag":"windows-security-descriptor-read-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}