{"record":{"id":"854898033946ed05","repo":"crowdsecurity/crowdsec","slug":"plugin-at-s-has-setgid-permission-which-is-not-a","errorCode":null,"errorMessage":"plugin at %s has setgid permission, which is not allowed","messagePattern":"plugin at (.+?) has setgid permission, which is not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils.go","lineNumber":127,"sourceCode":"\tcurrentUID, err := getUID(currentUser.Username)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while looking up the current uid: %w\", err)\n\t}\n\tstat := details.Sys().(*syscall.Stat_t)\n\tif stat.Uid != currentUID {\n\t\treturn fmt.Errorf(\"plugin at %s is not owned by user '%s'\", path, currentUser.Username)\n\t}\n\n\tmode := details.Mode()\n\tperm := uint32(mode)\n\tif (perm & 0o0002) != 0 {\n\t\treturn fmt.Errorf(\"plugin at %s is world writable, world writable plugins are invalid\", path)\n\t}\n\tif (perm & 0o0020) != 0 {\n\t\treturn fmt.Errorf(\"plugin at %s is group writable, group writable plugins are invalid\", path)\n\t}\n\tif (mode & os.ModeSetgid) != 0 {\n\t\treturn fmt.Errorf(\"plugin at %s has setgid permission, which is not allowed\", path)\n\t}\n\treturn nil\n}\n","sourceCodeStart":109,"sourceCodeEnd":131,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils.go#L109-L131","documentation":"pluginIsValid rejects plugin binaries carrying the setgid bit (os.ModeSetgid), because setgid execution elevates the process to the file's group and is unnecessary/dangerous for a plugin. This error means the mode contains setgid.","triggerScenarios":"pluginIsValid inspects details.Mode() for os.ModeSetgid and the bit is present on the plugin binary — usually from a stray 'chmod g+s' or an archive that preserved setgid bits.","commonSituations":"Copying binaries from another system with tar --preserve-permissions where setgid was set; accidental chmod 2755; build pipeline applying setgid to output artifacts.","solutions":["Remove the setgid bit: chmod g-s <plugin path> (or chmod 755)","Re-extract/reinstall the plugin without preserving special permission bits (tar -x --no-same-permissions)","Verify with stat -c '%a' <path> that no setgid (2xxx) mode remains"],"exampleFix":"// before\nchmod 2755 /usr/lib/crowdsec/plugins/notification-slack\n// after\nchmod 755 /usr/lib/crowdsec/plugins/notification-slack","handlingStrategy":"validation","validationCode":"info, _ := os.Stat(pluginPath)\nif info.Mode()&os.ModeSetgid != 0 {\n    return fmt.Errorf(\"%s has setgid bit\", pluginPath)\n}","typeGuard":null,"tryCatchPattern":"if err := pluginIsValid(path); err != nil {\n    if strings.Contains(err.Error(), \"setgid\") {\n        log.Fatalf(\"chmod g-s the plugin: %v\", err)\n    }\n    return err\n}","preventionTips":["Never use chmod g+s on plugin binaries","Extract archives with --no-same-permissions to drop setuid/setgid bits","Verify final mode with stat before starting crowdsec"],"tags":["go","plugin","permissions","security","setgid"],"backgroundTag":"insufficient-permissions","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}