crowdsecurity/crowdsec · error

while getting owner: %w

Error message

while getting owner: %w

What it means

After retrieving the security descriptor, CheckPerms extracts the owner SID via (*SECURITY_DESCRIPTOR).Owner() (wrapping Win32 GetSecurityDescriptorOwner) and verifies the SID is valid. This error wraps a failure of the Owner() accessor, which should only fail if the security descriptor memory is malformed.

Source

Thrown at pkg/csplugin/utils_windows.go:91

		return fmt.Errorf("while getting current user: %w", err)
	}

	currentUserSid, _, _, err := windows.LookupSID("", currentUser.Username)

	if err != nil {
		return fmt.Errorf("while looking up current user sid: %w", err)
	}

	sd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)
	if err != nil {
		return fmt.Errorf("while getting owner security info: %w", err)
	}
	if !sd.IsValid() {
		return errors.New("security descriptor is invalid")
	}
	owner, _, err := sd.Owner()
	if err != nil {
		return fmt.Errorf("while getting owner: %w", err)
	}
	if !owner.IsValid() {
		return errors.New("owner is invalid")
	}

	if !owner.Equals(systemSid) && !owner.Equals(currentUserSid) && !owner.Equals(adminSid) {
		return fmt.Errorf("plugin at %s is not owned by SYSTEM, Administrators or by current user, but by %s", path, owner.String())
	}

	dacl, _, err := sd.DACL()
	if err != nil {
		return fmt.Errorf("while getting DACL: %w", err)
	}

	if dacl == nil {
		return fmt.Errorf("no DACL found on plugin, meaning fully permissive access on plugin %s", path)
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Reset the plugin file's ACLs to defaults (`icacls <plugin> /reset`) and re-verify
2. Re-copy the plugin binary from a trusted source so a fresh security descriptor is created
3. Read the wrapped %w error for the specific Win32 failure code
4. If reproducible, check the storage volume/driver for corruption (chkdsk)

Example fix

// before
owner, _, err := sd.Owner()
if err != nil {
	return fmt.Errorf("while getting owner: %w", err)
}
// after
owner, _, err := sd.Owner()
if err != nil {
	return fmt.Errorf("while getting owner of %s security descriptor: %w", path, err)
}

// pre-validate the descriptor parses cleanly
sd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION)
if err == nil && !sd.IsValid() {
	return errors.New("security descriptor is corrupt before check")
}

err := CheckPerms(pluginPath)
if err != nil && strings.Contains(err.Error(), "while getting owner") {
	log.Warnf("corrupt owner SID on %s, reset ACLs with: icacls %s /reset", pluginPath, pluginPath)
}

When it happens

Trigger: Calling CheckPerms when sd.Owner() returns a non-nil error — the descriptor returned by GetNamedSecurityInfo is valid per IsValid() but its owner field cannot be read, an extremely rare low-level Win32 condition.

Common situations: Corrupted security descriptors produced by faulty backup/restore tools or third-party ACL editors; security software returning mangled descriptor data; filesystem driver issues on exotic storage.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• while getting owner security info: %w
• while getting DACL: %w
• no DACL found on plugin, meaning fully permissive access on
• while getting ACE: %w
• only SYSTEM, Administrators or the user currently running cr

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c7d61216bb20843e. Report an issue: GitHub.