crowdsecurity/crowdsec · error

while getting DACL: %w

Error message

while getting DACL: %w

What it means

CheckPerms retrieves the plugin's DACL via (*SECURITY_DESCRIPTOR).DACL() (wrapping GetSecurityDescriptorDacl) and fails if that accessor errors. This means Windows could not read the discretionary ACL from an otherwise-valid security descriptor — a low-level, rarely-seen condition.

Source

Thrown at pkg/csplugin/utils_windows.go:103

	}
	if !sd.IsValid() {
		return errors.New("security descriptor is invalid")
	}
	owner, _, err := sd.Owner()
	if err != nil {
		return fmt.Errorf("while getting owner: %w", err)
	}
	if !owner.IsValid() {
		return errors.New("owner is invalid")
	}

	if !owner.Equals(systemSid) && !owner.Equals(currentUserSid) && !owner.Equals(adminSid) {
		return fmt.Errorf("plugin at %s is not owned by SYSTEM, Administrators or by current user, but by %s", path, owner.String())
	}

	dacl, _, err := sd.DACL()
	if err != nil {
		return fmt.Errorf("while getting DACL: %w", err)
	}

	if dacl == nil {
		return fmt.Errorf("no DACL found on plugin, meaning fully permissive access on plugin %s", path)
	}

	rs := reflect.ValueOf(dacl).Elem()

	/*
			For reference, the structure of the ACL type is:
			type ACL struct {
			aclRevision byte
			sbz1        byte
			aclSize     uint16
			aceCount    uint16
			sbz2        uint16
		}
		As the field are not exported, we have to use reflection to access them, this should not be an issue as the structure won't (probably) change any time soon.

View on GitHub (pinned to 909b515798)

Solutions

1. Reset the file's security descriptor: `icacls <plugin> /reset`
2. Reinstall or re-copy the plugin binary to regenerate a clean descriptor
3. Read the wrapped %w error for the underlying Win32 code
4. Check the volume for filesystem corruption (chkdsk) if multiple files show the issue

Example fix

// before
dacl, _, err := sd.DACL()
if err != nil {
	return fmt.Errorf("while getting DACL: %w", err)
}
// after
dacl, _, err := sd.DACL()
if err != nil {
	return fmt.Errorf("while getting DACL of %s: %w", path, err)
}

sd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.DACL_SECURITY_INFORMATION)
if err != nil {
	return fmt.Errorf("DACL unreadable before plugin check: %w", err)
}
if !sd.IsValid() {
	return errors.New("security descriptor corrupt")
}

err := CheckPerms(pluginPath)
if err != nil && strings.Contains(err.Error(), "getting DACL") {
	log.Warnf("unreadable DACL on %s — reset with: icacls %s /reset", pluginPath, pluginPath)
}

When it happens

Trigger: Calling CheckPerms when sd.DACL() returns a non-nil error: the security descriptor's ACL pointer/size fields are inconsistent, usually due to a corrupted or non-standard descriptor on the plugin file.

Common situations: Descriptors mangled by third-party ACL tools or incomplete backup restores; filesystem corruption; exotic filter drivers interfering with security-info queries.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• while getting owner security info: %w
• while getting owner: %w
• no DACL found on plugin, meaning fully permissive access on
• while getting ACE: %w
• only SYSTEM, Administrators or the user currently running cr

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/28a26dc9902071fb. Report an issue: GitHub.