crowdsecurity/crowdsec · error

security descriptor is invalid

Error message

security descriptor is invalid

What it means

CheckPerms on Windows validates a plugin binary's ownership via its security descriptor. It throws 'security descriptor is invalid' when the SECURITY_DESCRIPTOR returned by windows.GetNamedSecurityInfo fails sd.IsValid(), meaning the descriptor cannot be trusted for an ownership check.

Source

Thrown at pkg/csplugin/utils_windows.go:87

	}

	currentUser, err := user.Current()
	if err != nil {
		return fmt.Errorf("while getting current user: %w", err)
	}

	currentUserSid, _, _, err := windows.LookupSID("", currentUser.Username)

	if err != nil {
		return fmt.Errorf("while looking up current user sid: %w", err)
	}

	sd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)
	if err != nil {
		return fmt.Errorf("while getting owner security info: %w", err)
	}
	if !sd.IsValid() {
		return errors.New("security descriptor is invalid")
	}
	owner, _, err := sd.Owner()
	if err != nil {
		return fmt.Errorf("while getting owner: %w", err)
	}
	if !owner.IsValid() {
		return errors.New("owner is invalid")
	}

	if !owner.Equals(systemSid) && !owner.Equals(currentUserSid) && !owner.Equals(adminSid) {
		return fmt.Errorf("plugin at %s is not owned by SYSTEM, Administrators or by current user, but by %s", path, owner.String())
	}

	dacl, _, err := sd.DACL()
	if err != nil {
		return fmt.Errorf("while getting DACL: %w", err)
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Reinstall/replace the plugin binary (e.g. re-run 'cscli plugins' install or re-download) to regenerate a valid security descriptor
2. Check and repair the file's ACLs with icacls <path> /reset
3. Verify the file isn't on a filesystem (e.g. some network mounts) that produces invalid descriptors

Example fix

null

null

null

if err := csplugin.CheckPerms(pluginPath); err != nil {
    if strings.Contains(err.Error(), "security descriptor is invalid") {
        // reinstall or quarantine the plugin
    }
    return fmt.Errorf("plugin %s rejected: %w", pluginPath, err)
}

When it happens

Trigger: Called by pluginIsValid during plugin loading: windows.GetNamedSecurityInfo succeeds at the API level but returns a self-inconsistent SECURITY_DESCRIPTOR (IsValid() false) for the plugin file path.

Common situations: Corrupted file ACLs on the plugin binary; files copied from unusual sources or filesystems that don't fully support NT security descriptors; antivirus or sync tools mangling security metadata.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• owner is invalid
• plugin at %s is world writable, world writable plugins are i
• plugin at %s is group writable, group writable plugins are i
• plugin at %s has setgid permission, which is not allowed
• plugin at %s is not owned by SYSTEM, Administrators or by cu

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c2ca8b5dc265d2ec. Report an issue: GitHub.