crowdsecurity/crowdsec · error

while getting current user: %w

Error message

while getting current user: %w

What it means

pluginIsValid needs the current process user (via os/user.Current) to compare the plugin file's owner against it. If user.Current fails the error is wrapped with this message. user.Current typically fails when cgo is disabled and the process cannot resolve the user from /etc/passwd, or when the uid has no passwd entry.

Source

Thrown at pkg/csplugin/utils.go:107

			Uid: uid,
			Gid: gid,
		},
	}, nil
}

func pluginIsValid(path string) error {
	var details fs.FileInfo
	var err error

	// check if it exists
	if details, err = os.Stat(path); err != nil {
		return fmt.Errorf("plugin at %s does not exist: %w", path, err)
	}

	// check if it is owned by current user
	currentUser, err := user.Current()
	if err != nil {
		return fmt.Errorf("while getting current user: %w", err)
	}
	currentUID, err := getUID(currentUser.Username)
	if err != nil {
		return fmt.Errorf("while looking up the current uid: %w", err)
	}
	stat := details.Sys().(*syscall.Stat_t)
	if stat.Uid != currentUID {
		return fmt.Errorf("plugin at %s is not owned by user '%s'", path, currentUser.Username)
	}

	mode := details.Mode()
	perm := uint32(mode)
	if (perm & 0o0002) != 0 {
		return fmt.Errorf("plugin at %s is world writable, world writable plugins are invalid", path)
	}
	if (perm & 0o0020) != 0 {
		return fmt.Errorf("plugin at %s is group writable, group writable plugins are invalid", path)
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Ensure the user running crowdsec has an entry in /etc/passwd (useradd or an entry in the container image)
2. Read the wrapped %w cause to identify whether it was a passwd lookup or NSS failure
3. If running in a container, run as a named user that exists in the image rather than --user=<arbitrary-uid>

if u, err := user.Current(); err != nil {
    log.Fatalf("current user not resolvable: %v", err)
} else if _, err := getpwnamWrapper(u.Username); err != nil {
    log.Fatalf("user %s has no passwd entry", u.Username)
}

if err := pluginIsValid(path); err != nil {
    if strings.Contains(err.Error(), "while getting current user") {
        log.Fatalf("fix passwd/NSS for the running uid: %v", err)
    }
    return err
}

When it happens

Trigger: pluginIsValid calls user.Current() which returns an error — commonly in statically-linked binaries (CGO_ENABLED=0) where os/user falls back to reading /etc/passwd and the uid has no matching entry, or passwd/NSS is unreadable.

Common situations: Running crowdsec as a uid with no /etc/passwd entry (e.g. arbitrary uid in a container); musl/static builds where cgo user lookup is unavailable; restricted /etc permissions.

Related errors

• while getting process attributes: %w
• while looking up the current uid: %w
• pid inside tag must be closed with ']'
• message is empty
• PRI must start with '<'

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/dd9009dfdea6732f. Report an issue: GitHub.