{"record":{"id":"c89b7e8e6dc4b7df","repo":"crowdsecurity/crowdsec","slug":"while-getting-process-attributes-w-c89b7e","errorCode":null,"errorMessage":"while getting process attributes: %w","messagePattern":"while getting process attributes: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils_windows.go","lineNumber":214,"sourceCode":"\terr = windows.SetTokenInformation(token, windows.TokenIntegrityLevel,\n\t\t(*byte)(unsafe.Pointer(tml)), tml.Size())\n\tif err != nil {\n\t\ttoken.Close()\n\t\treturn nil, fmt.Errorf(\"while setting token information: %w\", err)\n\t}\n\n\treturn &windows.SysProcAttr{\n\t\tCreationFlags: windows.CREATE_NEW_PROCESS_GROUP,\n\t\tToken:         syscall.Token(token),\n\t}, nil\n}\n\nfunc (*PluginBroker) CreateCmd(ctx context.Context, binaryPath string) (*exec.Cmd, error) {\n\tvar err error\n\tcmd := exec.CommandContext(ctx, binaryPath)\n\tcmd.SysProcAttr, err = getProcessAttr()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"while getting process attributes: %w\", err)\n\t}\n\treturn cmd, err\n}\n\nfunc getPluginTypeAndSubtypeFromPath(path string) (string, string, error) {\n\tpluginFileName := strings.TrimSuffix(filepath.Base(path), filepath.Ext(path))\n\n\tparts := strings.Split(pluginFileName, \"-\")\n\tif len(parts) < 2 {\n\t\treturn \"\", \"\", fmt.Errorf(\"plugin name %s is invalid. Name should be like {type-name}\", path)\n\t}\n\treturn strings.Join(parts[:len(parts)-1], \"-\"), parts[len(parts)-1], nil\n}\n\nfunc pluginIsValid(path string) error {\n\tvar err error\n\n\t// check if it exists","sourceCodeStart":196,"sourceCodeEnd":232,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils_windows.go#L196-L232","documentation":"This is the outer wrapper in PluginBroker.CreateCmd: it wraps any failure returned by getProcessAttr while building the windows.SysProcAttr used to launch a plugin subprocess with a restricted token. The inner cause (opened via %w) is one of the token errors — opening the process token, duplicating it, adjusting privileges, setting the integrity level, or creating the well-known SID.","triggerScenarios":"CreateCmd is called whenever the PluginBroker starts a notification plugin on Windows; it fails when any Windows token API in getProcessAttr returns an error — most commonly when crowdsec runs under an account or environment that denies token open/duplicate/modify operations.","commonSituations":"Deploying crowdsec on Windows under a restrictive service account; AV/EDR blocking token manipulation; hardened environments (containers, sandboxed services) where process tokens cannot be duplicated; corrupted Windows token state.","solutions":["Read the wrapped inner error in the log chain to identify which token API failed, then apply the corresponding fix.","Run the crowdsec service as LocalSystem or an administrator-equivalent account.","Add antivirus/EDR exclusions for the crowdsec binary and plugin directory.","Verify plugins can start with a minimal repro: run crowdsec manually from an elevated shell and check whether plugin startup succeeds."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if runtime.GOOS == \"windows\" {\n    var tok windows.Token\n    if err := windows.OpenProcessToken(windows.CurrentProcess(), windows.TOKEN_DUPLICATE|windows.TOKEN_QUERY, &tok); err != nil {\n        log.Warnf(\"plugins will fail to start on this Windows environment: %v\", err)\n    } else {\n        tok.Close()\n    }\n}","typeGuard":null,"tryCatchPattern":"cmd, err := broker.CreateCmd(ctx, binaryPath)\nif err != nil {\n    var errno syscall.Errno\n    if errors.As(err, &errno) {\n        log.Errorf(\"plugin launch failed at token step (errno=%d): %v\", errno, err)\n    }\n    return fmt.Errorf(\"cannot start plugin %s: %w\", binaryPath, err)\n}","preventionTips":["Run crowdsec as a service account that can open and modify its own token (LocalSystem).","Read the entire wrapped error chain to identify which token API failed before troubleshooting.","Add AV/EDR exclusions for crowdsec and plugin executables.","Validate plugin startup in staging after Windows hardening or policy updates."],"tags":["windows","subprocess","plugin","token"],"backgroundTag":"insufficient-permissions","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}