crowdsecurity/crowdsec · error

while getting process attributes: %w

Error message

while getting process attributes: %w

What it means

This is the outer wrapper in PluginBroker.CreateCmd: it wraps any failure returned by getProcessAttr while building the windows.SysProcAttr used to launch a plugin subprocess with a restricted token. The inner cause (opened via %w) is one of the token errors — opening the process token, duplicating it, adjusting privileges, setting the integrity level, or creating the well-known SID.

Source

Thrown at pkg/csplugin/utils_windows.go:214

	err = windows.SetTokenInformation(token, windows.TokenIntegrityLevel,
		(*byte)(unsafe.Pointer(tml)), tml.Size())
	if err != nil {
		token.Close()
		return nil, fmt.Errorf("while setting token information: %w", err)
	}

	return &windows.SysProcAttr{
		CreationFlags: windows.CREATE_NEW_PROCESS_GROUP,
		Token:         syscall.Token(token),
	}, nil
}

func (*PluginBroker) CreateCmd(ctx context.Context, binaryPath string) (*exec.Cmd, error) {
	var err error
	cmd := exec.CommandContext(ctx, binaryPath)
	cmd.SysProcAttr, err = getProcessAttr()
	if err != nil {
		return nil, fmt.Errorf("while getting process attributes: %w", err)
	}
	return cmd, err
}

func getPluginTypeAndSubtypeFromPath(path string) (string, string, error) {
	pluginFileName := strings.TrimSuffix(filepath.Base(path), filepath.Ext(path))

	parts := strings.Split(pluginFileName, "-")
	if len(parts) < 2 {
		return "", "", fmt.Errorf("plugin name %s is invalid. Name should be like {type-name}", path)
	}
	return strings.Join(parts[:len(parts)-1], "-"), parts[len(parts)-1], nil
}

func pluginIsValid(path string) error {
	var err error

	// check if it exists

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped inner error in the log chain to identify which token API failed, then apply the corresponding fix.
2. Run the crowdsec service as LocalSystem or an administrator-equivalent account.
3. Add antivirus/EDR exclusions for the crowdsec binary and plugin directory.
4. Verify plugins can start with a minimal repro: run crowdsec manually from an elevated shell and check whether plugin startup succeeds.

if runtime.GOOS == "windows" {
    var tok windows.Token
    if err := windows.OpenProcessToken(windows.CurrentProcess(), windows.TOKEN_DUPLICATE|windows.TOKEN_QUERY, &tok); err != nil {
        log.Warnf("plugins will fail to start on this Windows environment: %v", err)
    } else {
        tok.Close()
    }
}

cmd, err := broker.CreateCmd(ctx, binaryPath)
if err != nil {
    var errno syscall.Errno
    if errors.As(err, &errno) {
        log.Errorf("plugin launch failed at token step (errno=%d): %v", errno, err)
    }
    return fmt.Errorf("cannot start plugin %s: %w", binaryPath, err)
}

When it happens

Trigger: CreateCmd is called whenever the PluginBroker starts a notification plugin on Windows; it fails when any Windows token API in getProcessAttr returns an error — most commonly when crowdsec runs under an account or environment that denies token open/duplicate/modify operations.

Common situations: Deploying crowdsec on Windows under a restrictive service account; AV/EDR blocking token manipulation; hardened environments (containers, sandboxed services) where process tokens cannot be duplicated; corrupted Windows token state.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• security descriptor is invalid
• owner is invalid
• while adjusting token privileges: %w
• while setting token information: %w
• invalid log level

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c89b7e8e6dc4b7df. Report an issue: GitHub.