{"record":{"id":"5d6b0c79d5b13c7e","repo":"crowdsecurity/crowdsec","slug":"plugin-at-s-is-world-writable-world-writable-plu","errorCode":null,"errorMessage":"plugin at %s is world writable, world writable plugins are invalid","messagePattern":"plugin at (.+?) is world writable, world writable plugins are invalid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils.go","lineNumber":121,"sourceCode":"\n\t// check if it is owned by current user\n\tcurrentUser, err := user.Current()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting current user: %w\", err)\n\t}\n\tcurrentUID, err := getUID(currentUser.Username)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while looking up the current uid: %w\", err)\n\t}\n\tstat := details.Sys().(*syscall.Stat_t)\n\tif stat.Uid != currentUID {\n\t\treturn fmt.Errorf(\"plugin at %s is not owned by user '%s'\", path, currentUser.Username)\n\t}\n\n\tmode := details.Mode()\n\tperm := uint32(mode)\n\tif (perm & 0o0002) != 0 {\n\t\treturn fmt.Errorf(\"plugin at %s is world writable, world writable plugins are invalid\", path)\n\t}\n\tif (perm & 0o0020) != 0 {\n\t\treturn fmt.Errorf(\"plugin at %s is group writable, group writable plugins are invalid\", path)\n\t}\n\tif (mode & os.ModeSetgid) != 0 {\n\t\treturn fmt.Errorf(\"plugin at %s has setgid permission, which is not allowed\", path)\n\t}\n\treturn nil\n}\n","sourceCodeStart":103,"sourceCodeEnd":131,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils.go#L103-L131","documentation":"pluginIsValid rejects plugin binaries that are world-writable (mode bit 0o0002 set), because any local user could replace the executable that crowdsec will run. This hardening error indicates the file mode allows others to write.","triggerScenarios":"pluginIsValid checks perm & 0o0002 on the plugin file and the bit is set — e.g. the binary was copied with umask 000 or chmod 777/666 was applied.","commonSituations":"Manual deployment with overly permissive chmod; extracting an archive that preserves lax permissions; a script that creates the plugin file with 0777 defaults.","solutions":["Remove the world-write bit: chmod o-w <plugin path> (or chmod 755)","Set a sane umask (022) when installing plugin binaries","Re-check the mode with ls -l after fixing; all four write checks in pluginIsValid must pass"],"exampleFix":"// before\nchmod 777 /usr/lib/crowdsec/plugins/notification-slack\n// after\nchmod 755 /usr/lib/crowdsec/plugins/notification-slack","handlingStrategy":"validation","validationCode":"info, _ := os.Stat(pluginPath)\nif info.Mode().Perm()&0o002 != 0 {\n    return fmt.Errorf(\"%s is world-writable\", pluginPath)\n}","typeGuard":null,"tryCatchPattern":"if err := pluginIsValid(path); err != nil {\n    if strings.Contains(err.Error(), \"world writable\") {\n        log.Fatalf(\"chmod o-w the plugin: %v\", err)\n    }\n    return err\n}","preventionTips":["Deploy plugin binaries with mode 0755 (install -m 755)","Set umask 022 in install scripts and CI packaging","Audit plugin directory permissions periodically"],"tags":["go","plugin","permissions","security"],"backgroundTag":"insufficient-permissions","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}