plugin at %s is group writable, group writable plugins are i

Error message

plugin at %s is group writable, group writable plugins are invalid

What it means

pluginIsValid rejects plugin binaries that are group-writable (mode bit 0o0020 set), since any member of the file's group could modify the executable crowdsec runs. This is a hardening check analogous to the world-writable one.

Source

Thrown at pkg/csplugin/utils.go:124

	if err != nil {
		return fmt.Errorf("while getting current user: %w", err)
	}
	currentUID, err := getUID(currentUser.Username)
	if err != nil {
		return fmt.Errorf("while looking up the current uid: %w", err)
	}
	stat := details.Sys().(*syscall.Stat_t)
	if stat.Uid != currentUID {
		return fmt.Errorf("plugin at %s is not owned by user '%s'", path, currentUser.Username)
	}

	mode := details.Mode()
	perm := uint32(mode)
	if (perm & 0o0002) != 0 {
		return fmt.Errorf("plugin at %s is world writable, world writable plugins are invalid", path)
	}
	if (perm & 0o0020) != 0 {
		return fmt.Errorf("plugin at %s is group writable, group writable plugins are invalid", path)
	}
	if (mode & os.ModeSetgid) != 0 {
		return fmt.Errorf("plugin at %s has setgid permission, which is not allowed", path)
	}
	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

Remove the group-write bit: chmod g-w <plugin path> (or chmod 755)
Install the plugin with a umask of 022 so group write is not set by default
If the packaging tooling sets g+w, fix the install command to use install -m 755

Example fix

// before
install -m 775 notification-slack /usr/lib/crowdsec/plugins/
// after
install -m 755 notification-slack /usr/lib/crowdsec/plugins/

Defensive patterns

Strategy: validation

Validate before calling

info, _ := os.Stat(pluginPath)
if info.Mode().Perm()&0o020 != 0 {
    return fmt.Errorf("%s is group-writable", pluginPath)
}

Try / catch

if err := pluginIsValid(path); err != nil {
    if strings.Contains(err.Error(), "group writable") {
        log.Fatalf("chmod g-w the plugin: %v", err)
    }
    return err
}

Prevention

Use umask 022 (Debian default 002 sets g+w — override in install scripts)
Install with install -m 755 instead of cp + chmod later
Keep the owning group narrow and non-writable

When it happens

Trigger: pluginIsValid checks perm & 0o0020 on the plugin file and the bit is set — the file mode grants write permission to the owning group (e.g. chmod 775/664 or group is too broad).

Common situations: Plugin installed with group-write permissions inherited from a shared workspace; umask 002 on Debian-style systems where files are created g+w; plugin owned by a group with many members.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/fd55a14e41d6fd52. Report an issue: GitHub.