crowdsecurity/crowdsec · error
out of bound uid
Error message
out of bound uid
What it means
getUID resolves a username to a numeric uid via user.Lookup and parses it as int32. Because SysProcAttr credentials use uint32, but a negative or >MaxInt32 value cannot be a valid Linux uid, getUID returns 'out of bound uid' instead of producing a corrupt credential.
Source
Thrown at pkg/csplugin/utils.go:48
if err != nil {
return nil, fmt.Errorf("while getting process attributes: %w", err)
}
cmd.SysProcAttr.Credential.NoSetGroups = true
}
return cmd, err
}
func getUID(username string) (uint32, error) {
u, err := user.Lookup(username)
if err != nil {
return 0, err
}
uid, err := strconv.ParseInt(u.Uid, 10, 32)
if err != nil {
return 0, err
}
if uid < 0 || uid > math.MaxInt32 {
return 0, errors.New("out of bound uid")
}
return uint32(uid), nil
}
func getGID(groupname string) (uint32, error) {
g, err := user.LookupGroup(groupname)
if err != nil {
return 0, err
}
gid, err := strconv.ParseInt(g.Gid, 10, 32)
if err != nil {
return 0, err
}
if gid < 0 || gid > math.MaxInt32 {
return 0, errors.New("out of bound gid")
}
return uint32(gid), nil
}View on GitHub (pinned to 909b515798)
Solutions
- Inspect the resolved uid: getent passwd <username> and fix the malformed entry in the user database source
- Use a normal system user (uid < 2^31) for the plugin process config
- If NSS/LDAP is the source, correct the uidNumber mapping for that account
Example fix
// before (/etc/passwd) crowdsec:x:99999999999:::/home/crowdsec:/bin/false // after crowdsec:x:998:998::/home/crowdsec:/bin/false
Defensive patterns
Strategy: validation
Validate before calling
u, err := user.Lookup(username)
if err != nil {
return err
}
uid, err := strconv.Atoi(u.Uid)
if err != nil || uid < 0 || uid > math.MaxInt32 {
return fmt.Errorf("user %q has invalid uid %q", username, u.Uid)
} Try / catch
if attr, err := getProcessAttr(username, group); err != nil {
if strings.Contains(err.Error(), "out of bound uid") {
log.Fatalf("account %q has a malformed uid in the system user database", username)
}
return err
} Prevention
- Check `getent passwd <user>` output for a sane numeric uid before configuring it
- Avoid users sourced from LDAP/NSS backends with unvalidated uidNumber values
- Create a dedicated local system user for plugin privilege dropping
When it happens
Trigger: Calling getProcessAttr/pluginIsValid with a username whose /etc/passwd uid is negative or larger than 2147483647 — practically only when the user database (NSS/LDAP) returns a malformed or oversized uid.
Common situations: Corrupted /etc/passwd entry; misconfigured LDAP/SSO NSS source returning huge numeric ids; uid fields polluted with non-numeric-looking data that still parses as int.
Understand the failure class
Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.
Related errors
- group_name is mandatory for CloudwatchSource
- path must start with /
- basic_auth is selected, but basic_auth is not provided
- basic_auth is selected, but username is not provided
- basic_auth is selected, but password is not provided
AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06).
Data as JSON: /api/errors/64884ca95528d2c6.
Report an issue: GitHub.