What causes "failed to open feature flags file: %w" in crowdsecurity/crowdsec?

Check file permissions: the runtime user needs read access (chmod/chown)

failed to open feature flags file: %w

Error message

failed to open feature flags file: %w

What it means

SetFromYamlFile opens the feature-flags config file at the given path and delegates parsing to SetFromYaml. A missing file is treated as 'no flags' (nil return), but any other open failure — permission denied, path is a directory, I/O error — is wrapped as this error.

Source

Thrown at pkg/fflag/features.go:244

			return err
		}

		logger.Debugf("Feature flag: %s=true (from config file). %s", k, feat.Description)
	}

	return nil
}

func (fr *FeatureRegister) SetFromYamlFile(path string, logger *logrus.Logger) error {
	f, err := os.Open(path)
	if err != nil {
		if os.IsNotExist(err) {
			logger.Tracef("Feature flags config file '%s' does not exist", path)

			return nil
		}

		return fmt.Errorf("failed to open feature flags file: %w", err)
	}
	defer f.Close()

	logger.Debugf("Reading feature flags from %s", path)

	return fr.SetFromYaml(f, logger)
}

// GetEnabledFeatures returns the list of features that have been enabled by the user
func (fr *FeatureRegister) GetEnabledFeatures() []string {
	ret := make([]string, 0)

	for k, feat := range fr.features {
		if feat.IsEnabled() {
			ret = append(ret, k)
		}
	}

View on GitHub (pinned to 909b515798)

Solutions

Check file permissions: the runtime user needs read access (chmod/chown)
Verify the path points to a regular file, not a directory
Inspect the wrapped OS error (after the colon) for the exact cause
Move/recreate the config file in the standard config directory (/etc/crowdsec/)

Example fix

// fix typical permission problem
sudo chown crowdsec:crowdsec /etc/crowdsec/feature_flags.yaml
sudo chmod 644 /etc/crowdsec/feature_flags.yaml

Defensive patterns

Strategy: try-catch

Validate before calling

if st, err := os.Stat(path); err != nil || st.IsDir() {
    return fmt.Errorf("feature flags path %q not a readable file", path)
}

Try / catch

if err := fr.SetFromYamlFile(path, logger); err != nil {
    if strings.HasPrefix(err.Error(), "failed to open feature flags file") {
        // non-fatal: log and continue with default flags
        logger.Warnf("cannot read %s: %v", path, err)
        return nil
    }
    return err
}

Prevention

Ensure the runtime user can read the config directory and file
Never point the path at a directory
Set 0644 on feature flag files after editing as root
Rely on the built-in nil return for genuinely missing files — only other open errors surface here

When it happens

Trigger: Calling SetFromYamlFile(path) where the file exists but cannot be opened: no read permission, path resolves to a directory, device error, or symlink loop.

Common situations: Feature-flags file owned by root while crowdsec runs as another user; config path pointing at a directory; overly restrictive umask after manual config editing.

Understand the failure class

Background: "open() failed", "failed to open file", "cannot create file" — what a file open error means and how to fix it — this error's family across 42 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/aeb90eff6f972ef0. Report an issue: GitHub.