{"record":{"id":"abf55e94e407d85a","repo":"JuliusBrussee/caveman","slug":"native-runtime-current-user-sid-unavailable","errorCode":null,"errorMessage":"native runtime current user SID: unavailable","messagePattern":"native runtime current user SID: unavailable","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/internal/nativeruntime/server_windows.go","lineNumber":46,"sourceCode":"}\n\nfunc dialNativeRuntime(ctx context.Context, home string) (net.Conn, error) {\n\treturn winio.DialPipeContext(ctx, SocketPath(home))\n}\n\n// Serve exposes the same bounded JSON protocol over a user-only Windows named\n// pipe. go-winio rejects remote clients at pipe creation; explicit owner SID\n// ACL prevents another local user from attaching.\nfunc Serve(ctx context.Context, home string, runtime *Runtime) error {\n\tif runtime == nil || runtime.store == nil {\n\t\treturn errors.New(\"native runtime: store is required\")\n\t}\n\tuser, err := windows.GetCurrentProcessToken().GetTokenUser()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"native runtime current user SID: %w\", err)\n\t}\n\tif user == nil || user.User.Sid == nil {\n\t\treturn errors.New(\"native runtime current user SID: unavailable\")\n\t}\n\tsddl := \"D:P(A;;GA;;;\" + user.User.Sid.String() + \")\"\n\tlistener, err := winio.ListenPipe(SocketPath(home), &winio.PipeConfig{\n\t\tSecurityDescriptor: sddl,\n\t\tInputBufferSize:    maxRequestBytes,\n\t\tOutputBufferSize:   maxRequestBytes,\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"native runtime named-pipe listen: %w\", err)\n\t}\n\tdefer listener.Close()\n\tgo func() {\n\t\t<-ctx.Done()\n\t\t_ = listener.Close()\n\t}()\n\tfor {\n\t\tconn, err := listener.Accept()\n\t\tif err != nil {","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/proxy/internal/nativeruntime/server_windows.go#L28-L64","documentation":"On Windows, Serve builds an owner-only SDDL ACL from the current process token's user SID. If GetTokenUser succeeds but returns nil user or nil SID, the security descriptor cannot be constructed and the pipe cannot be safely restricted to one user, so Serve fails closed instead of opening an unsecured pipe.","triggerScenarios":"Running the runtime under an account whose token exposes no user SID — some service accounts, sandboxed contexts, or tokens mangled by privilege-dropping/impersonation; unusual Windows container or SSH-session token configurations.","commonSituations":"Running as SYSTEM via a custom service wrapper that strips token info; running inside restricted containers (Server Core variants, sandboxing products); CI agents with modified token privileges.","solutions":["Run the runtime under a normal user account with a well-formed token (interactive user or standard service account)","If running as a service, configure the service logon account so the process token carries a user SID","Check for impersonation in the parent process that may have replaced the process token"],"exampleFix":"// before: launching via a wrapper that calls ImpersonateNamedPipeClient before Serve\n// token has no owner SID -> error\n\n// after: call Serve on a process whose own token carries the user SID\nerr := nativeruntime.Serve(ctx, home, rt) // run directly under the user account, not under impersonation","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := nativeruntime.Serve(ctx, home, rt); err != nil {\n    if strings.Contains(err.Error(), \"SID: unavailable\") {\n        // relaunch under a normal user account / unmodified service token\n    }\n}","preventionTips":["Run the runtime under a standard user or service account with a complete process token","Avoid launching Serve from impersonated or heavily stripped token contexts"],"tags":["nativeruntime","windows","named-pipe","security","sid"],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}