{"record":{"id":"a4d2efeed9c3d951","repo":"crowdsecurity/crowdsec","slug":"while-looking-up-the-current-uid-w","errorCode":null,"errorMessage":"while looking up the current uid: %w","messagePattern":"while looking up the current uid: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils.go","lineNumber":111,"sourceCode":"}\n\nfunc pluginIsValid(path string) error {\n\tvar details fs.FileInfo\n\tvar err error\n\n\t// check if it exists\n\tif details, err = os.Stat(path); err != nil {\n\t\treturn fmt.Errorf(\"plugin at %s does not exist: %w\", path, err)\n\t}\n\n\t// check if it is owned by current user\n\tcurrentUser, err := user.Current()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting current user: %w\", err)\n\t}\n\tcurrentUID, err := getUID(currentUser.Username)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while looking up the current uid: %w\", err)\n\t}\n\tstat := details.Sys().(*syscall.Stat_t)\n\tif stat.Uid != currentUID {\n\t\treturn fmt.Errorf(\"plugin at %s is not owned by user '%s'\", path, currentUser.Username)\n\t}\n\n\tmode := details.Mode()\n\tperm := uint32(mode)\n\tif (perm & 0o0002) != 0 {\n\t\treturn fmt.Errorf(\"plugin at %s is world writable, world writable plugins are invalid\", path)\n\t}\n\tif (perm & 0o0020) != 0 {\n\t\treturn fmt.Errorf(\"plugin at %s is group writable, group writable plugins are invalid\", path)\n\t}\n\tif (mode & os.ModeSetgid) != 0 {\n\t\treturn fmt.Errorf(\"plugin at %s has setgid permission, which is not allowed\", path)\n\t}\n\treturn nil","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils.go#L93-L129","documentation":"After obtaining the current user, pluginIsValid resolves its username back to a numeric uid with getUID for comparison against the file owner. Failure of that userdb lookup produces this wrapped error.","triggerScenarios":"pluginIsValid calls getUID(currentUser.Username) and the underlying user.Lookup fails — the reported username has no passwd entry (mismatch between username and uid, e.g. uid 1000 with no matching record), so uid resolution errors.","commonSituations":"Container images where the passwd entry was removed but the process still runs as a named user; LDAP/NSS user databases unavailable; hostname of user sanitized in minimal images.","solutions":["Check that getent passwd <username> resolves on the host; add the missing passwd entry","Ensure NSS is functioning (nsswitch.conf not broken) if users come from LDAP/AD","As a workaround run crowdsec as a locally defined user present in /etc/passwd"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if _, err := user.Lookup(currentUser.Username); err != nil {\n    return fmt.Errorf(\"cannot resolve uid for %s\", currentUser.Username)\n}","typeGuard":null,"tryCatchPattern":"if err := pluginIsValid(path); err != nil {\n    if strings.Contains(err.Error(), \"while looking up the current uid\") {\n        log.Fatalf(\"add passwd entry for the current user: %v\", err)\n    }\n    return err\n}","preventionTips":["Ensure getent passwd <user> resolves for the service user on every host","Keep nsswitch.conf and NSS modules intact on hosts using LDAP/AD users","Prefer local system users for the crowdsec service"],"tags":["go","user-lookup","uid","nss"],"backgroundTag":"user-not-found","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}