crowdsecurity/crowdsec · error

owner is invalid

Error message

owner is invalid

What it means

CheckPerms validates that a plugin binary is owned by a trusted principal. After retrieving the owner SID it throws 'owner is invalid' when owner.IsValid() fails, i.e. the owner SID from the security descriptor cannot be resolved into a valid SID object.

Source

Thrown at pkg/csplugin/utils_windows.go:94

	currentUserSid, _, _, err := windows.LookupSID("", currentUser.Username)

	if err != nil {
		return fmt.Errorf("while looking up current user sid: %w", err)
	}

	sd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)
	if err != nil {
		return fmt.Errorf("while getting owner security info: %w", err)
	}
	if !sd.IsValid() {
		return errors.New("security descriptor is invalid")
	}
	owner, _, err := sd.Owner()
	if err != nil {
		return fmt.Errorf("while getting owner: %w", err)
	}
	if !owner.IsValid() {
		return errors.New("owner is invalid")
	}

	if !owner.Equals(systemSid) && !owner.Equals(currentUserSid) && !owner.Equals(adminSid) {
		return fmt.Errorf("plugin at %s is not owned by SYSTEM, Administrators or by current user, but by %s", path, owner.String())
	}

	dacl, _, err := sd.DACL()
	if err != nil {
		return fmt.Errorf("while getting DACL: %w", err)
	}

	if dacl == nil {
		return fmt.Errorf("no DACL found on plugin, meaning fully permissive access on plugin %s", path)
	}

	rs := reflect.ValueOf(dacl).Elem()

	/*

View on GitHub (pinned to 909b515798)

Solutions

1. Reinstall the plugin binary so it is re-owned by a valid account
2. Take ownership with 'icacls <path> /setowner Administrators' or takeown /f <path>
3. Ensure the plugin is owned by SYSTEM, Administrators, or the current user, as required

Example fix

null

null

null

if err := csplugin.CheckPerms(pluginPath); err != nil {
    return fmt.Errorf("plugin ownership check failed for %s: %w", pluginPath, err)
}

When it happens

Trigger: Called by pluginIsValid during plugin loading: the security descriptor is valid but sd.Owner() returns a SID that fails IsValid().

Common situations: Files with orphaned/deleted owner accounts; binaries transferred from another machine with unresolvable SIDs; corrupted ACL metadata after a restore or copy.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• security descriptor is invalid
• plugin at %s is world writable, world writable plugins are i
• plugin at %s is group writable, group writable plugins are i
• plugin at %s has setgid permission, which is not allowed
• plugin at %s is not owned by SYSTEM, Administrators or by cu

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/7dc3a349c9a04aa4. Report an issue: GitHub.