crowdsecurity/crowdsec · error

plugin at %s has setgid permission, which is not allowed

Error message

plugin at %s has setgid permission, which is not allowed

What it means

pluginIsValid rejects plugin binaries carrying the setgid bit (os.ModeSetgid), because setgid execution elevates the process to the file's group and is unnecessary/dangerous for a plugin. This error means the mode contains setgid.

Source

Thrown at pkg/csplugin/utils.go:127

	currentUID, err := getUID(currentUser.Username)
	if err != nil {
		return fmt.Errorf("while looking up the current uid: %w", err)
	}
	stat := details.Sys().(*syscall.Stat_t)
	if stat.Uid != currentUID {
		return fmt.Errorf("plugin at %s is not owned by user '%s'", path, currentUser.Username)
	}

	mode := details.Mode()
	perm := uint32(mode)
	if (perm & 0o0002) != 0 {
		return fmt.Errorf("plugin at %s is world writable, world writable plugins are invalid", path)
	}
	if (perm & 0o0020) != 0 {
		return fmt.Errorf("plugin at %s is group writable, group writable plugins are invalid", path)
	}
	if (mode & os.ModeSetgid) != 0 {
		return fmt.Errorf("plugin at %s has setgid permission, which is not allowed", path)
	}
	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Remove the setgid bit: chmod g-s <plugin path> (or chmod 755)
2. Re-extract/reinstall the plugin without preserving special permission bits (tar -x --no-same-permissions)
3. Verify with stat -c '%a' <path> that no setgid (2xxx) mode remains

Example fix

// before
chmod 2755 /usr/lib/crowdsec/plugins/notification-slack
// after
chmod 755 /usr/lib/crowdsec/plugins/notification-slack

info, _ := os.Stat(pluginPath)
if info.Mode()&os.ModeSetgid != 0 {
    return fmt.Errorf("%s has setgid bit", pluginPath)
}

if err := pluginIsValid(path); err != nil {
    if strings.Contains(err.Error(), "setgid") {
        log.Fatalf("chmod g-s the plugin: %v", err)
    }
    return err
}

When it happens

Trigger: pluginIsValid inspects details.Mode() for os.ModeSetgid and the bit is present on the plugin binary — usually from a stray 'chmod g+s' or an archive that preserved setgid bits.

Common situations: Copying binaries from another system with tar --preserve-permissions where setgid was set; accidental chmod 2755; build pipeline applying setgid to output artifacts.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• plugin at %s is world writable, world writable plugins are i
• plugin at %s is group writable, group writable plugins are i
• security descriptor is invalid
• owner is invalid
• plugin at %s is not owned by user '%s'

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/854898033946ed05. Report an issue: GitHub.