crowdsecurity/crowdsec · error

while getting owner: %w

Error message

while getting owner: %w

What it means

setFilePerm on Windows failed while extracting the owner SID from the security descriptor returned by GetNamedSecurityInfo (sd.Owner()). If the owner cannot be resolved from the descriptor, the function cannot rebuild the DACL and returns this error.

Source

Thrown at pkg/database/file_utils_windows.go:22

	"fmt"
	"io/fs"

	log "github.com/sirupsen/logrus"
	"golang.org/x/sys/windows"
)

func setFilePerm(path string, mode fs.FileMode) error {
	//On windows, we don't care about the mode, just make sure the file is only readable/writable by the owner and group

	sd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION)
	if err != nil {
		return fmt.Errorf("while getting security info: %w", err)
	}

	currentOwner, defaulted, err := sd.Owner()

	if err != nil {
		return fmt.Errorf("while getting owner: %w", err)
	}

	log.Debugf("current owner is %s (%v) (defaulted: %v)", currentOwner.String(), currentOwner, defaulted)

	currentGroup, defaulted, err := sd.Group()

	if err != nil {
		return fmt.Errorf("while getting group: %w", err)
	}

	if currentGroup == nil {
		log.Debugf("current group is nil (defaulted: %v), using builtin admin instead", defaulted)
		currentGroup, err = windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
		if err != nil {
			return fmt.Errorf("while creating admin SID: %w", err)
		}
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Reset the file's security descriptor: `icacls <path> /reset` (as administrator) then restart crowdsec.
2. Take ownership of the file: `takeown /f <path>` and re-run.
3. Recreate the file (move the data directory contents) so a fresh descriptor is generated.

err := setFilePerm(path, 0600)
if err != nil {
	log.Warnf("perm change failed: %v", err)
	// fall back: recreate file with default ACLs
}

When it happens

Trigger: sd.Owner() returning an error on the descriptor fetched for the target file: descriptor is malformed/truncated, or the SID in the owner field cannot be converted (corrupt or non-standard security descriptor).

Common situations: Files copied from another volume/system with damaged security descriptors; files whose owner SID references an unresolvable domain account.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• while getting group: %w
• only SYSTEM, Administrators or the user currently running cr
• while getting security info: %w
• while creating ACL: %w
• while setting security info: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/424421c0702bd434. Report an issue: GitHub.