{"record":{"id":"d8e60cdc7f9493bc","repo":"crowdsecurity/crowdsec","slug":"while-getting-process-attributes-w","errorCode":null,"errorMessage":"while getting process attributes: %w","messagePattern":"while getting process attributes: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils.go","lineNumber":31,"sourceCode":"\t\"os/user\"\n\t\"path/filepath\"\n\t\"strconv\"\n\t\"strings\"\n\t\"syscall\"\n\n\t\"golang.org/x/sys/unix\"\n)\n\nfunc (pb *PluginBroker) CreateCmd(ctx context.Context, binaryPath string) (*exec.Cmd, error) {\n\tvar err error\n\tcmd := exec.CommandContext(ctx, binaryPath)\n\tif pb.pluginProcConfig.User != \"\" || pb.pluginProcConfig.Group != \"\" {\n\t\tif pb.pluginProcConfig.User == \"\" || pb.pluginProcConfig.Group == \"\" {\n\t\t\treturn nil, errors.New(\"while getting process attributes: both plugin user and group must be set\")\n\t\t}\n\t\tcmd.SysProcAttr, err = getProcessAttr(pb.pluginProcConfig.User, pb.pluginProcConfig.Group)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"while getting process attributes: %w\", err)\n\t\t}\n\t\tcmd.SysProcAttr.Credential.NoSetGroups = true\n\t}\n\treturn cmd, err\n}\n\nfunc getUID(username string) (uint32, error) {\n\tu, err := user.Lookup(username)\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\tuid, err := strconv.ParseInt(u.Uid, 10, 32)\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\tif uid < 0 || uid > math.MaxInt32 {\n\t\treturn 0, errors.New(\"out of bound uid\")\n\t}","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils.go#L13-L49","documentation":"CreateCmd wraps any failure from getProcessAttr, which resolves the configured plugin user/group to uid/gid values via os/user lookups. The wrapper preserves the underlying cause (%w) while attributing it to the plugin process-attribute setup step. It only fires when both user and group are configured for the notification plugin.","triggerScenarios":"loadNotificationPlugin calls CreateCmd with pluginProcConfig.User and pluginProcConfig.Group both set, and getProcessAttr fails because the username or groupname cannot be resolved to a uid/gid on the system (or the underlying unix call otherwise errors).","commonSituations":"config/auth.yaml (or profiles notification_config) specifies a 'user'/'group' for a plugin that does not exist on the host, e.g. copied config from another machine referencing 'crowdsec' user before it was created; running in a container where the user/group entries are absent from /etc/passwd or /etc/group.","solutions":["Check which user/group is configured for the plugin and verify it exists on the host: getent passwd <user> and getent group <group>","Create the missing user/group, or remove/adjust the user and group keys in the plugin's config so they match an existing account","Read the wrapped %w cause in the full error chain to see whether it was the user or the group lookup that failed"],"exampleFix":"# before (config/auth.yaml)\nname: crowdsecurity/http\nuser: crowdsec\ngroup: crowdsec\n# after\nname: crowdsecurity/http\nuser: www-data\ngroup: www-data","handlingStrategy":"validation","validationCode":"if cfg.User != \"\" || cfg.Group != \"\" {\n    if _, err := user.Lookup(cfg.User); err != nil {\n        return fmt.Errorf(\"plugin user %q does not exist\", cfg.User)\n    }\n    if _, err := user.LookupGroup(cfg.Group); err != nil {\n        return fmt.Errorf(\"plugin group %q does not exist\", cfg.Group)\n    }\n}","typeGuard":null,"tryCatchPattern":"cmd, err := CreateCmd(...)\nif err != nil {\n    var ue *user.UnknownUserError\n    if errors.As(err, &ue) { log.Fatalf(\"create plugin user first: %v\", ue) }\n    return err\n}","preventionTips":["Always create the plugin user/group (useradd/groupadd) before enabling user/group keys in the plugin config","Keep the configured user/group identical across environments (bake into container images)","Never set only one of user/group — both are required"],"tags":["go","plugin","user-lookup","config"],"backgroundTag":"user-not-found","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}