{"record":{"id":"dd9009dfdea6732f","repo":"crowdsecurity/crowdsec","slug":"while-getting-current-user-w","errorCode":null,"errorMessage":"while getting current user: %w","messagePattern":"while getting current user: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils.go","lineNumber":107,"sourceCode":"\t\t\tUid: uid,\n\t\t\tGid: gid,\n\t\t},\n\t}, nil\n}\n\nfunc pluginIsValid(path string) error {\n\tvar details fs.FileInfo\n\tvar err error\n\n\t// check if it exists\n\tif details, err = os.Stat(path); err != nil {\n\t\treturn fmt.Errorf(\"plugin at %s does not exist: %w\", path, err)\n\t}\n\n\t// check if it is owned by current user\n\tcurrentUser, err := user.Current()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting current user: %w\", err)\n\t}\n\tcurrentUID, err := getUID(currentUser.Username)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while looking up the current uid: %w\", err)\n\t}\n\tstat := details.Sys().(*syscall.Stat_t)\n\tif stat.Uid != currentUID {\n\t\treturn fmt.Errorf(\"plugin at %s is not owned by user '%s'\", path, currentUser.Username)\n\t}\n\n\tmode := details.Mode()\n\tperm := uint32(mode)\n\tif (perm & 0o0002) != 0 {\n\t\treturn fmt.Errorf(\"plugin at %s is world writable, world writable plugins are invalid\", path)\n\t}\n\tif (perm & 0o0020) != 0 {\n\t\treturn fmt.Errorf(\"plugin at %s is group writable, group writable plugins are invalid\", path)\n\t}","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils.go#L89-L125","documentation":"pluginIsValid needs the current process user (via os/user.Current) to compare the plugin file's owner against it. If user.Current fails the error is wrapped with this message. user.Current typically fails when cgo is disabled and the process cannot resolve the user from /etc/passwd, or when the uid has no passwd entry.","triggerScenarios":"pluginIsValid calls user.Current() which returns an error — commonly in statically-linked binaries (CGO_ENABLED=0) where os/user falls back to reading /etc/passwd and the uid has no matching entry, or passwd/NSS is unreadable.","commonSituations":"Running crowdsec as a uid with no /etc/passwd entry (e.g. arbitrary uid in a container); musl/static builds where cgo user lookup is unavailable; restricted /etc permissions.","solutions":["Ensure the user running crowdsec has an entry in /etc/passwd (useradd or an entry in the container image)","Read the wrapped %w cause to identify whether it was a passwd lookup or NSS failure","If running in a container, run as a named user that exists in the image rather than --user=<arbitrary-uid>"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if u, err := user.Current(); err != nil {\n    log.Fatalf(\"current user not resolvable: %v\", err)\n} else if _, err := getpwnamWrapper(u.Username); err != nil {\n    log.Fatalf(\"user %s has no passwd entry\", u.Username)\n}","typeGuard":null,"tryCatchPattern":"if err := pluginIsValid(path); err != nil {\n    if strings.Contains(err.Error(), \"while getting current user\") {\n        log.Fatalf(\"fix passwd/NSS for the running uid: %v\", err)\n    }\n    return err\n}","preventionTips":["Run crowdsec as a named user that exists in /etc/passwd","Avoid arbitrary --user=<uid> in containers unless a passwd entry exists","Test static builds with the intended runtime user before deploying"],"tags":["go","user-lookup","os-user","container"],"backgroundTag":"user-lookup-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}