crowdsecurity/crowdsec · error

while creating %s: %w

Error message

while creating %s: %w

What it means

writeEmbeddedContentTo fails while creating the parent directory of destPath via os.MkdirAll before writing the embedded content. The wrapped os error indicates why the directory could not be created (permissions, path is a file, full disk).

Source

Thrown at pkg/cwhub/fetch.go:36

// If the content is base64 encoded, it will be decoded before writing. Call this method only
// if item.Content if not empty.
func (i *Item) writeEmbeddedContentTo(destPath, wantHash string) error {
	if i.Content == "" {
		return fmt.Errorf("no embedded content for %s", i.Name)
	}

	content, err := base64.StdEncoding.DecodeString(i.Content)
	if err != nil {
		content = []byte(i.Content)
	}

	dir := filepath.Dir(destPath)
	reader := bytes.NewReader(content)
	hash := crypto.SHA256.New()

	tee := io.TeeReader(reader, hash)
	if err := os.MkdirAll(dir, 0o755); err != nil {
		return fmt.Errorf("while creating %s: %w", dir, err)
	}

	f, err := os.OpenFile(destPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o600)
	if err != nil {
		return err
	}

	defer f.Close()

	if _, err := io.Copy(f, tee); err != nil {
		return err
	}

	gotHash := hex.EncodeToString(hash.Sum(nil))
	if gotHash != wantHash {
		return fmt.Errorf("%w. The index file is invalid, please run 'cscli hub update' and try again",
			downloader.HashMismatchError{
				Expected: wantHash,

View on GitHub (pinned to 909b515798)

Solutions

1. Run the command with appropriate privileges (sudo)
2. Check that no regular file exists at the directory path: `ls -la` the parent path
3. Verify filesystem is writable and not full: `df -h`, `mount -o remount,rw ...`
4. Check SELinux/AppArmor denials in audit logs

Example fix

// before
cscli hub update   # as unprivileged user
// after
sudo cscli hub update

dir := filepath.Dir(destPath)
if st, err := os.Stat(dir); err == nil && !st.IsDir() {
    return fmt.Errorf("%s exists and is not a directory", dir)
}
if err := os.MkdirAll(dir, 0o755); err != nil {
    return err // surface early with full context
}

if err := item.FetchContentTo(ctx, provider, dest); err != nil {
    var pe *os.PathError
    if errors.As(err, &pe) {
        logger.Errorf("filesystem error on %s: %v (check permissions/disk)", pe.Path, pe.Err)
        return
    }
    return err
}

When it happens

Trigger: Fetching content for an item whose destination directory does not exist and cannot be created — e.g. /etc/crowdsec/<type> missing with root-only parent dirs, or a path component being a regular file.

Common situations: Running cscli/crowdsec without sufficient privileges, a file existing where a directory is expected, read-only filesystem, or SELinux/AppArmor restrictions on /etc/crowdsec or /var/lib/crowdsec.

Understand the failure class

Background: mkdir permission denied (EACCES): failed to create directory errors explained — this error's family across 32 libraries.

Related errors

• while creating %s: %w
• while creating directories for %s: %w
• while creating symlink from %s to %s: %w
• unable to create folder '%s': %w
• while creating data dir: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/52ecebe65a4ef574. Report an issue: GitHub.