{"record":{"id":"5ee97acf16dcbe60","repo":"crowdsecurity/crowdsec","slug":"while-getting-owner-security-info-w","errorCode":null,"errorMessage":"while getting owner security info: %w","messagePattern":"while getting owner security info: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils_windows.go","lineNumber":84,"sourceCode":"\tadminSid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinBuiltinAdministratorsSid))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while creating built-in Administrators well known sid: %w\", err)\n\t}\n\n\tcurrentUser, err := user.Current()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting current user: %w\", err)\n\t}\n\n\tcurrentUserSid, _, _, err := windows.LookupSID(\"\", currentUser.Username)\n\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while looking up current user sid: %w\", err)\n\t}\n\n\tsd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting owner security info: %w\", err)\n\t}\n\tif !sd.IsValid() {\n\t\treturn errors.New(\"security descriptor is invalid\")\n\t}\n\towner, _, err := sd.Owner()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting owner: %w\", err)\n\t}\n\tif !owner.IsValid() {\n\t\treturn errors.New(\"owner is invalid\")\n\t}\n\n\tif !owner.Equals(systemSid) && !owner.Equals(currentUserSid) && !owner.Equals(adminSid) {\n\t\treturn fmt.Errorf(\"plugin at %s is not owned by SYSTEM, Administrators or by current user, but by %s\", path, owner.String())\n\t}\n\n\tdacl, _, err := sd.DACL()\n\tif err != nil {","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils_windows.go#L66-L102","documentation":"CheckPerms queries the plugin file's security descriptor with windows.GetNamedSecurityInfo(SE_FILE_OBJECT, OWNER|DACL), the Win32 GetNamedSecurityInfo API. This error wraps a failure of that call, meaning Windows could not return the object's owner and DACL information — typically an OS error like ERROR_ACCESS_DENIED, ERROR_FILE_NOT_FOUND, or ERROR_INVALID_OWNER.","triggerScenarios":"Calling CheckPerms on a path where GetNamedSecurityInfo fails: the file was deleted between the earlier os.Stat and this call; the caller lacks READ_CONTROL on the file; the path is malformed or on a filesystem that doesn't support NT security descriptors (FAT32, some network shares).","commonSituations":"Plugin directory on a FAT32/exFAT volume or network share without NT ACL support; antivirus or EDR blocking security-descriptor queries; race where the plugin binary is replaced/removed while crowdsec scans; crowdsec run by an account with no read-control access to the plugin file.","solutions":["Verify the plugin file still exists at the path and is on an NTFS volume that supports ACLs","Run crowdsec under an account with READ_CONTROL access to the plugin directory, or fix the ACLs on the plugin files","Check antivirus/EDR software isn't blocking security-descriptor queries on the plugin path","Read the wrapped %w Win32 error to distinguish not-found vs access-denied and act accordingly"],"exampleFix":"// before\nsd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)\nif err != nil {\n\treturn fmt.Errorf(\"while getting owner security info: %w\", err)\n}\n// after\nif _, err := os.Stat(path); err != nil {\n\treturn fmt.Errorf(\"plugin vanished before security check: %w\", err)\n}\nsd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)\nif err != nil {\n\treturn fmt.Errorf(\"while getting owner security info for %s: %w\", path, err)\n}","handlingStrategy":"try-catch","validationCode":"if fi, err := os.Stat(path); err != nil {\n\treturn fmt.Errorf(\"plugin missing: %w\", err)\n} else if fi.Mode()&os.ModeType != 0 {\n\treturn errors.New(\"path is not a regular file\")\n}","typeGuard":null,"tryCatchPattern":"err := CheckPerms(pluginPath)\nvar errno windows.Errno\nif err != nil && errors.As(err, &errno) && errno == windows.ERROR_ACCESS_DENIED {\n\treturn fmt.Errorf(\"grant READ_CONTROL on %s to the crowdsec account\", pluginPath)\n}","preventionTips":["Install plugins on NTFS volumes only","Keep the plugin file stable during scanning (no concurrent overwrite)","Grant the crowdsec service account READ_CONTROL on the plugin directory","Whitelist the plugin directory in antivirus/EDR policies"],"tags":["windows","acl","security","filesystem"],"backgroundTag":"permission-denied","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}