plugin at %s is world writable, world writable plugins are i

Error message

plugin at %s is world writable, world writable plugins are invalid

What it means

pluginIsValid rejects plugin binaries that are world-writable (mode bit 0o0002 set), because any local user could replace the executable that crowdsec will run. This hardening error indicates the file mode allows others to write.

Source

Thrown at pkg/csplugin/utils.go:121

	// check if it is owned by current user
	currentUser, err := user.Current()
	if err != nil {
		return fmt.Errorf("while getting current user: %w", err)
	}
	currentUID, err := getUID(currentUser.Username)
	if err != nil {
		return fmt.Errorf("while looking up the current uid: %w", err)
	}
	stat := details.Sys().(*syscall.Stat_t)
	if stat.Uid != currentUID {
		return fmt.Errorf("plugin at %s is not owned by user '%s'", path, currentUser.Username)
	}

	mode := details.Mode()
	perm := uint32(mode)
	if (perm & 0o0002) != 0 {
		return fmt.Errorf("plugin at %s is world writable, world writable plugins are invalid", path)
	}
	if (perm & 0o0020) != 0 {
		return fmt.Errorf("plugin at %s is group writable, group writable plugins are invalid", path)
	}
	if (mode & os.ModeSetgid) != 0 {
		return fmt.Errorf("plugin at %s has setgid permission, which is not allowed", path)
	}
	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

Remove the world-write bit: chmod o-w <plugin path> (or chmod 755)
Set a sane umask (022) when installing plugin binaries
Re-check the mode with ls -l after fixing; all four write checks in pluginIsValid must pass

Example fix

// before
chmod 777 /usr/lib/crowdsec/plugins/notification-slack
// after
chmod 755 /usr/lib/crowdsec/plugins/notification-slack

Defensive patterns

Strategy: validation

Validate before calling

info, _ := os.Stat(pluginPath)
if info.Mode().Perm()&0o002 != 0 {
    return fmt.Errorf("%s is world-writable", pluginPath)
}

Try / catch

if err := pluginIsValid(path); err != nil {
    if strings.Contains(err.Error(), "world writable") {
        log.Fatalf("chmod o-w the plugin: %v", err)
    }
    return err
}

Prevention

Deploy plugin binaries with mode 0755 (install -m 755)
Set umask 022 in install scripts and CI packaging
Audit plugin directory permissions periodically

When it happens

Trigger: pluginIsValid checks perm & 0o0002 on the plugin file and the bit is set — e.g. the binary was copied with umask 000 or chmod 777/666 was applied.

Common situations: Manual deployment with overly permissive chmod; extracting an archive that preserves lax permissions; a script that creates the plugin file with 0777 defaults.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/5d6b0c79d5b13c7e. Report an issue: GitHub.