{"record":{"id":"87615921b978537c","repo":"crowdsecurity/crowdsec","slug":"while-getting-security-info-w","errorCode":null,"errorMessage":"while getting security info: %w","messagePattern":"while getting security info: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/database/file_utils_windows.go","lineNumber":16,"sourceCode":"package database\n\nimport (\n\t\"fmt\"\n\t\"io/fs\"\n\n\tlog \"github.com/sirupsen/logrus\"\n\t\"golang.org/x/sys/windows\"\n)\n\nfunc setFilePerm(path string, mode fs.FileMode) error {\n\t//On windows, we don't care about the mode, just make sure the file is only readable/writable by the owner and group\n\n\tsd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting security info: %w\", err)\n\t}\n\n\tcurrentOwner, defaulted, err := sd.Owner()\n\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting owner: %w\", err)\n\t}\n\n\tlog.Debugf(\"current owner is %s (%v) (defaulted: %v)\", currentOwner.String(), currentOwner, defaulted)\n\n\tcurrentGroup, defaulted, err := sd.Group()\n\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting group: %w\", err)\n\t}\n\n\tif currentGroup == nil {\n\t\tlog.Debugf(\"current group is nil (defaulted: %v), using builtin admin instead\", defaulted)","sourceCodeStart":1,"sourceCodeEnd":34,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/file_utils_windows.go#L1-L34","documentation":"On Windows, setFilePerm restricts a file to owner/group access via Windows security descriptors. This error is returned when windows.GetNamedSecurityInfo fails to read the file's current security descriptor (OWNER_SECURITY_INFORMATION). Without the descriptor, CrowdSec cannot preserve the owner while rewriting the DACL.","triggerScenarios":"Calling setFilePerm (invoked when writing SQLite DB / lock files on Windows) when GetNamedSecurityInfo fails: the path doesn't exist, the caller lacks READ_CONTROL on the file, or the path is on a filesystem not supporting ACLs (FAT32, network share).","commonSituations":"CrowdSec data directory placed on a FAT32/USB drive or network share without ACL support; antivirus or permissions blocking READ_CONTROL; file deleted between creation and perm setting.","solutions":["Move the CrowdSec data directory (db_path) to a local NTFS volume.","Check the file exists and the service account has READ_CONTROL/ownership read rights on it.","Exclude the CrowdSec data directory from antivirus interference and verify with icacls <path>.","Check the wrapped error for ERROR_FILE_NOT_FOUND vs ERROR_ACCESS_DENIED to distinguish path vs permission causes."],"exampleFix":"// before: blindly setting perm on a possibly-shared path\nerr := setFilePerm(dbPath, 0600)\n// after: ensure NTFS-supporting local path first\nif fi, ferr := os.Stat(dbPath); ferr != nil || !fi.Mode().IsRegular() {\n\treturn fmt.Errorf(\"db path %s missing or invalid\", dbPath)\n}\nerr := setFilePerm(dbPath, 0600)","handlingStrategy":"validation","validationCode":"// Go (Windows): verify path exists before perm change\nif _, err := os.Stat(path); err != nil {\n\treturn fmt.Errorf(\"file %s not available: %w\", path, err)\n}","typeGuard":null,"tryCatchPattern":"err := setFilePerm(path, 0600)\nif err != nil {\n\tlog.Warnf(\"could not restrict permissions on %s: %v\", path, err)\n\t// verify effective ACLs manually or relocate data dir\n}","preventionTips":["Keep crowdsec data on a local NTFS volume, never FAT32 or network shares.","Run the service with an account that can read security descriptors on its own data.","Exclude the data directory from aggressive AV/backup tooling."],"tags":["windows","acl","filesystem","permissions"],"backgroundTag":"permission-denied","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}