{"record":{"id":"64884ca95528d2c6","repo":"crowdsecurity/crowdsec","slug":"out-of-bound-uid","errorCode":null,"errorMessage":"out of bound uid","messagePattern":"out of bound uid","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils.go","lineNumber":48,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"while getting process attributes: %w\", err)\n\t\t}\n\t\tcmd.SysProcAttr.Credential.NoSetGroups = true\n\t}\n\treturn cmd, err\n}\n\nfunc getUID(username string) (uint32, error) {\n\tu, err := user.Lookup(username)\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\tuid, err := strconv.ParseInt(u.Uid, 10, 32)\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\tif uid < 0 || uid > math.MaxInt32 {\n\t\treturn 0, errors.New(\"out of bound uid\")\n\t}\n\treturn uint32(uid), nil\n}\n\nfunc getGID(groupname string) (uint32, error) {\n\tg, err := user.LookupGroup(groupname)\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\tgid, err := strconv.ParseInt(g.Gid, 10, 32)\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\tif gid < 0 || gid > math.MaxInt32 {\n\t\treturn 0, errors.New(\"out of bound gid\")\n\t}\n\treturn uint32(gid), nil\n}","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils.go#L30-L66","documentation":"getUID resolves a username to a numeric uid via user.Lookup and parses it as int32. Because SysProcAttr credentials use uint32, but a negative or >MaxInt32 value cannot be a valid Linux uid, getUID returns 'out of bound uid' instead of producing a corrupt credential.","triggerScenarios":"Calling getProcessAttr/pluginIsValid with a username whose /etc/passwd uid is negative or larger than 2147483647 — practically only when the user database (NSS/LDAP) returns a malformed or oversized uid.","commonSituations":"Corrupted /etc/passwd entry; misconfigured LDAP/SSO NSS source returning huge numeric ids; uid fields polluted with non-numeric-looking data that still parses as int.","solutions":["Inspect the resolved uid: getent passwd <username> and fix the malformed entry in the user database source","Use a normal system user (uid < 2^31) for the plugin process config","If NSS/LDAP is the source, correct the uidNumber mapping for that account"],"exampleFix":"// before (/etc/passwd)\ncrowdsec:x:99999999999:::/home/crowdsec:/bin/false\n\n// after\ncrowdsec:x:998:998::/home/crowdsec:/bin/false","handlingStrategy":"validation","validationCode":"u, err := user.Lookup(username)\nif err != nil {\n    return err\n}\nuid, err := strconv.Atoi(u.Uid)\nif err != nil || uid < 0 || uid > math.MaxInt32 {\n    return fmt.Errorf(\"user %q has invalid uid %q\", username, u.Uid)\n}","typeGuard":null,"tryCatchPattern":"if attr, err := getProcessAttr(username, group); err != nil {\n    if strings.Contains(err.Error(), \"out of bound uid\") {\n        log.Fatalf(\"account %q has a malformed uid in the system user database\", username)\n    }\n    return err\n}","preventionTips":["Check `getent passwd <user>` output for a sane numeric uid before configuring it","Avoid users sourced from LDAP/NSS backends with unvalidated uidNumber values","Create a dedicated local system user for plugin privilege dropping"],"tags":["unix","permissions","validation"],"backgroundTag":"value-out-of-range","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}