{"record":{"id":"c2ca8b5dc265d2ec","repo":"crowdsecurity/crowdsec","slug":"security-descriptor-is-invalid","errorCode":null,"errorMessage":"security descriptor is invalid","messagePattern":"security descriptor is invalid","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils_windows.go","lineNumber":87,"sourceCode":"\t}\n\n\tcurrentUser, err := user.Current()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting current user: %w\", err)\n\t}\n\n\tcurrentUserSid, _, _, err := windows.LookupSID(\"\", currentUser.Username)\n\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while looking up current user sid: %w\", err)\n\t}\n\n\tsd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting owner security info: %w\", err)\n\t}\n\tif !sd.IsValid() {\n\t\treturn errors.New(\"security descriptor is invalid\")\n\t}\n\towner, _, err := sd.Owner()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting owner: %w\", err)\n\t}\n\tif !owner.IsValid() {\n\t\treturn errors.New(\"owner is invalid\")\n\t}\n\n\tif !owner.Equals(systemSid) && !owner.Equals(currentUserSid) && !owner.Equals(adminSid) {\n\t\treturn fmt.Errorf(\"plugin at %s is not owned by SYSTEM, Administrators or by current user, but by %s\", path, owner.String())\n\t}\n\n\tdacl, _, err := sd.DACL()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting DACL: %w\", err)\n\t}\n","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils_windows.go#L69-L105","documentation":"CheckPerms on Windows validates a plugin binary's ownership via its security descriptor. It throws 'security descriptor is invalid' when the SECURITY_DESCRIPTOR returned by windows.GetNamedSecurityInfo fails sd.IsValid(), meaning the descriptor cannot be trusted for an ownership check.","triggerScenarios":"Called by pluginIsValid during plugin loading: windows.GetNamedSecurityInfo succeeds at the API level but returns a self-inconsistent SECURITY_DESCRIPTOR (IsValid() false) for the plugin file path.","commonSituations":"Corrupted file ACLs on the plugin binary; files copied from unusual sources or filesystems that don't fully support NT security descriptors; antivirus or sync tools mangling security metadata.","solutions":["Reinstall/replace the plugin binary (e.g. re-run 'cscli plugins' install or re-download) to regenerate a valid security descriptor","Check and repair the file's ACLs with icacls <path> /reset","Verify the file isn't on a filesystem (e.g. some network mounts) that produces invalid descriptors"],"exampleFix":"null","handlingStrategy":"try-catch","validationCode":"null","typeGuard":"null","tryCatchPattern":"if err := csplugin.CheckPerms(pluginPath); err != nil {\n    if strings.Contains(err.Error(), \"security descriptor is invalid\") {\n        // reinstall or quarantine the plugin\n    }\n    return fmt.Errorf(\"plugin %s rejected: %w\", pluginPath, err)\n}","preventionTips":["Download plugins from trusted sources and avoid copying them across machines with robocopy-less tools","Run icacls to check file ACLs after manual plugin installs","Keep plugins on NTFS, not network/FAT filesystems"],"tags":["windows","security","plugin","permissions"],"backgroundTag":"insufficient-permissions","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}