{"record":{"id":"fd55a14e41d6fd52","repo":"crowdsecurity/crowdsec","slug":"plugin-at-s-is-group-writable-group-writable-plu","errorCode":null,"errorMessage":"plugin at %s is group writable, group writable plugins are invalid","messagePattern":"plugin at (.+?) is group writable, group writable plugins are invalid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils.go","lineNumber":124,"sourceCode":"\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting current user: %w\", err)\n\t}\n\tcurrentUID, err := getUID(currentUser.Username)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while looking up the current uid: %w\", err)\n\t}\n\tstat := details.Sys().(*syscall.Stat_t)\n\tif stat.Uid != currentUID {\n\t\treturn fmt.Errorf(\"plugin at %s is not owned by user '%s'\", path, currentUser.Username)\n\t}\n\n\tmode := details.Mode()\n\tperm := uint32(mode)\n\tif (perm & 0o0002) != 0 {\n\t\treturn fmt.Errorf(\"plugin at %s is world writable, world writable plugins are invalid\", path)\n\t}\n\tif (perm & 0o0020) != 0 {\n\t\treturn fmt.Errorf(\"plugin at %s is group writable, group writable plugins are invalid\", path)\n\t}\n\tif (mode & os.ModeSetgid) != 0 {\n\t\treturn fmt.Errorf(\"plugin at %s has setgid permission, which is not allowed\", path)\n\t}\n\treturn nil\n}\n","sourceCodeStart":106,"sourceCodeEnd":131,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils.go#L106-L131","documentation":"pluginIsValid rejects plugin binaries that are group-writable (mode bit 0o0020 set), since any member of the file's group could modify the executable crowdsec runs. This is a hardening check analogous to the world-writable one.","triggerScenarios":"pluginIsValid checks perm & 0o0020 on the plugin file and the bit is set — the file mode grants write permission to the owning group (e.g. chmod 775/664 or group is too broad).","commonSituations":"Plugin installed with group-write permissions inherited from a shared workspace; umask 002 on Debian-style systems where files are created g+w; plugin owned by a group with many members.","solutions":["Remove the group-write bit: chmod g-w <plugin path> (or chmod 755)","Install the plugin with a umask of 022 so group write is not set by default","If the packaging tooling sets g+w, fix the install command to use install -m 755"],"exampleFix":"// before\ninstall -m 775 notification-slack /usr/lib/crowdsec/plugins/\n// after\ninstall -m 755 notification-slack /usr/lib/crowdsec/plugins/","handlingStrategy":"validation","validationCode":"info, _ := os.Stat(pluginPath)\nif info.Mode().Perm()&0o020 != 0 {\n    return fmt.Errorf(\"%s is group-writable\", pluginPath)\n}","typeGuard":null,"tryCatchPattern":"if err := pluginIsValid(path); err != nil {\n    if strings.Contains(err.Error(), \"group writable\") {\n        log.Fatalf(\"chmod g-w the plugin: %v\", err)\n    }\n    return err\n}","preventionTips":["Use umask 022 (Debian default 002 sets g+w — override in install scripts)","Install with install -m 755 instead of cp + chmod later","Keep the owning group narrow and non-writable"],"tags":["go","plugin","permissions","security"],"backgroundTag":"insufficient-permissions","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}