{"record":{"id":"7dc3a349c9a04aa4","repo":"crowdsecurity/crowdsec","slug":"owner-is-invalid","errorCode":null,"errorMessage":"owner is invalid","messagePattern":"owner is invalid","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils_windows.go","lineNumber":94,"sourceCode":"\tcurrentUserSid, _, _, err := windows.LookupSID(\"\", currentUser.Username)\n\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while looking up current user sid: %w\", err)\n\t}\n\n\tsd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting owner security info: %w\", err)\n\t}\n\tif !sd.IsValid() {\n\t\treturn errors.New(\"security descriptor is invalid\")\n\t}\n\towner, _, err := sd.Owner()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting owner: %w\", err)\n\t}\n\tif !owner.IsValid() {\n\t\treturn errors.New(\"owner is invalid\")\n\t}\n\n\tif !owner.Equals(systemSid) && !owner.Equals(currentUserSid) && !owner.Equals(adminSid) {\n\t\treturn fmt.Errorf(\"plugin at %s is not owned by SYSTEM, Administrators or by current user, but by %s\", path, owner.String())\n\t}\n\n\tdacl, _, err := sd.DACL()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting DACL: %w\", err)\n\t}\n\n\tif dacl == nil {\n\t\treturn fmt.Errorf(\"no DACL found on plugin, meaning fully permissive access on plugin %s\", path)\n\t}\n\n\trs := reflect.ValueOf(dacl).Elem()\n\n\t/*","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils_windows.go#L76-L112","documentation":"CheckPerms validates that a plugin binary is owned by a trusted principal. After retrieving the owner SID it throws 'owner is invalid' when owner.IsValid() fails, i.e. the owner SID from the security descriptor cannot be resolved into a valid SID object.","triggerScenarios":"Called by pluginIsValid during plugin loading: the security descriptor is valid but sd.Owner() returns a SID that fails IsValid().","commonSituations":"Files with orphaned/deleted owner accounts; binaries transferred from another machine with unresolvable SIDs; corrupted ACL metadata after a restore or copy.","solutions":["Reinstall the plugin binary so it is re-owned by a valid account","Take ownership with 'icacls <path> /setowner Administrators' or takeown /f <path>","Ensure the plugin is owned by SYSTEM, Administrators, or the current user, as required"],"exampleFix":"null","handlingStrategy":"try-catch","validationCode":"null","typeGuard":"null","tryCatchPattern":"if err := csplugin.CheckPerms(pluginPath); err != nil {\n    return fmt.Errorf(\"plugin ownership check failed for %s: %w\", pluginPath, err)\n}","preventionTips":["Install plugins as Administrator so the owner is Administrators or the current user","Avoid extracting plugins from archives that preserve foreign SIDs","Re-take ownership with takeown after restoring from backups"],"tags":["windows","security","plugin","permissions"],"backgroundTag":"insufficient-permissions","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}