crowdsecurity/crowdsec · error

while looking up the current uid: %w

Error message

while looking up the current uid: %w

What it means

After obtaining the current user, pluginIsValid resolves its username back to a numeric uid with getUID for comparison against the file owner. Failure of that userdb lookup produces this wrapped error.

Source

Thrown at pkg/csplugin/utils.go:111

}

func pluginIsValid(path string) error {
	var details fs.FileInfo
	var err error

	// check if it exists
	if details, err = os.Stat(path); err != nil {
		return fmt.Errorf("plugin at %s does not exist: %w", path, err)
	}

	// check if it is owned by current user
	currentUser, err := user.Current()
	if err != nil {
		return fmt.Errorf("while getting current user: %w", err)
	}
	currentUID, err := getUID(currentUser.Username)
	if err != nil {
		return fmt.Errorf("while looking up the current uid: %w", err)
	}
	stat := details.Sys().(*syscall.Stat_t)
	if stat.Uid != currentUID {
		return fmt.Errorf("plugin at %s is not owned by user '%s'", path, currentUser.Username)
	}

	mode := details.Mode()
	perm := uint32(mode)
	if (perm & 0o0002) != 0 {
		return fmt.Errorf("plugin at %s is world writable, world writable plugins are invalid", path)
	}
	if (perm & 0o0020) != 0 {
		return fmt.Errorf("plugin at %s is group writable, group writable plugins are invalid", path)
	}
	if (mode & os.ModeSetgid) != 0 {
		return fmt.Errorf("plugin at %s has setgid permission, which is not allowed", path)
	}
	return nil

View on GitHub (pinned to 909b515798)

Solutions

1. Check that getent passwd <username> resolves on the host; add the missing passwd entry
2. Ensure NSS is functioning (nsswitch.conf not broken) if users come from LDAP/AD
3. As a workaround run crowdsec as a locally defined user present in /etc/passwd

if _, err := user.Lookup(currentUser.Username); err != nil {
    return fmt.Errorf("cannot resolve uid for %s", currentUser.Username)
}

if err := pluginIsValid(path); err != nil {
    if strings.Contains(err.Error(), "while looking up the current uid") {
        log.Fatalf("add passwd entry for the current user: %v", err)
    }
    return err
}

When it happens

Trigger: pluginIsValid calls getUID(currentUser.Username) and the underlying user.Lookup fails — the reported username has no passwd entry (mismatch between username and uid, e.g. uid 1000 with no matching record), so uid resolution errors.

Common situations: Container images where the passwd entry was removed but the process still runs as a named user; LDAP/NSS user databases unavailable; hostname of user sanitized in minimal images.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

• while getting process attributes: %w
• while getting current user: %w
• pid inside tag must be closed with ']'
• message is empty
• PRI must start with '<'

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/a4d2efeed9c3d951. Report an issue: GitHub.