crowdsecurity/crowdsec · error

while creating ACL: %w

Error message

while creating ACL: %w

What it means

setFilePerm on Windows failed while building the new DACL from the ACCESS_ALLOWED_ACE entries for owner and group via windows.ACLFromEntries. If the ACL object cannot be constructed, the restrictive permissions cannot be applied to the file.

Source

Thrown at pkg/database/file_utils_windows.go:70

					TrusteeType:              windows.TRUSTEE_IS_USER,
					TrusteeValue:             windows.TrusteeValueFromSID(currentOwner),
				},
			},
			{
				AccessPermissions: windows.GENERIC_ALL,
				AccessMode:        windows.GRANT_ACCESS,
				Inheritance:       windows.NO_INHERITANCE,
				Trustee: windows.TRUSTEE{
					MultipleTrusteeOperation: windows.NO_MULTIPLE_TRUSTEE,
					TrusteeForm:              windows.TRUSTEE_IS_SID,
					TrusteeType:              windows.TRUSTEE_IS_GROUP,
					TrusteeValue:             windows.TrusteeValueFromSID(currentGroup),
				},
			},
		}, nil)

	if err != nil {
		return fmt.Errorf("while creating ACL: %w", err)
	}

	err = windows.SetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.DACL_SECURITY_INFORMATION|windows.PROTECTED_DACL_SECURITY_INFORMATION, nil, nil, dacl, nil)

	if err != nil {
		return fmt.Errorf("while setting security info: %w", err)
	}
	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Reset the file's security descriptor (`icacls <path> /reset`) so clean SIDs are re-read, then restart crowdsec.
2. Recreate the file/database on a local NTFS volume.
3. Check the wrapped Win32 error code for the precise API failure.

err := setFilePerm(path, 0600)
if err != nil {
	log.Warnf("ACL build failed for %s: %v", path, err)
	// check the wrapped Win32 error for the exact cause
}

When it happens

Trigger: ACLFromEntries failing for the owner/group ACEs built from the previously resolved SIDs — e.g. invalid SID blob, ACE construction failure, or Win32 API error (ERROR_INVALID_SECURITY_DESCR / out of memory).

Common situations: Extremely rare; seen when previously-resolved SIDs are malformed (descriptor corruption) or under memory pressure in long-running services.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• only SYSTEM, Administrators or the user currently running cr
• while getting security info: %w
• while getting owner: %w
• while getting group: %w
• while setting security info: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/23419e4ef9b8dc06. Report an issue: GitHub.