crowdsecurity/crowdsec · error

while getting group: %w

Error message

while getting group: %w

What it means

setFilePerm on Windows failed while reading the group SID from the security descriptor (sd.Group()). The group SID is needed to grant group access in the new DACL; if Group() fails, the permission change aborts.

Source

Thrown at pkg/database/file_utils_windows.go:30

	//On windows, we don't care about the mode, just make sure the file is only readable/writable by the owner and group

	sd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION)
	if err != nil {
		return fmt.Errorf("while getting security info: %w", err)
	}

	currentOwner, defaulted, err := sd.Owner()

	if err != nil {
		return fmt.Errorf("while getting owner: %w", err)
	}

	log.Debugf("current owner is %s (%v) (defaulted: %v)", currentOwner.String(), currentOwner, defaulted)

	currentGroup, defaulted, err := sd.Group()

	if err != nil {
		return fmt.Errorf("while getting group: %w", err)
	}

	if currentGroup == nil {
		log.Debugf("current group is nil (defaulted: %v), using builtin admin instead", defaulted)
		currentGroup, err = windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
		if err != nil {
			return fmt.Errorf("while creating admin SID: %w", err)
		}
	}

	log.Debugf("current group is %s (%v) (defaulted: %v)", currentGroup.String(), currentGroup, defaulted)

	dacl, err := windows.ACLFromEntries(
		[]windows.EXPLICIT_ACCESS{
			{
				AccessPermissions: windows.GENERIC_ALL,
				AccessMode:        windows.GRANT_ACCESS,
				Inheritance:       windows.NO_INHERITANCE,

View on GitHub (pinned to 909b515798)

Solutions

1. Reset the descriptor with `icacls <path> /reset` and retry.
2. Take ownership with `takeown /f <path>` so a fresh group SID is set.
3. Recreate the file on a local NTFS volume with default ACLs.

err := setFilePerm(path, 0600)
if err != nil {
	log.Warnf("perm change failed: %v", err)
}

When it happens

Trigger: sd.Group() returning an error on the descriptor fetched for the target file, typically a malformed group SID in the file's security descriptor.

Common situations: Security descriptors created by third-party tools or transferred from other systems (WSL/NFS copies) with unusable group SIDs.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• while getting owner: %w
• only SYSTEM, Administrators or the user currently running cr
• while getting security info: %w
• while creating ACL: %w
• while setting security info: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ebd0da71c583ce80. Report an issue: GitHub.