What causes "while removing symlink: %w" in crowdsecurity/crowdsec?

Run the command with sufficient privileges (sudo/root)

while removing symlink: %w

Error message

while removing symlink: %w

What it means

Once the symlink is verified as hub-managed, RemoveInstallLink deletes it with os.Remove. If deletion fails, the error is wrapped as 'while removing symlink: %w' — typically a filesystem permission or I/O problem.

Source

Thrown at pkg/hubops/disable.go:35

		return err
	}

	// if it's managed by hub, it's a symlink to csconfig.GConfig.hub.HubDir / ...
	if stat.Mode()&os.ModeSymlink == 0 {
		return fmt.Errorf("%s isn't managed by hub", i.Name)
	}

	target, err := os.Readlink(i.State.LocalPath)
	if err != nil {
		return fmt.Errorf("while reading symlink: %w", err)
	}

	if target != i.State.DownloadPath {
		return fmt.Errorf("%s isn't managed by hub", i.Name)
	}

	if err := os.Remove(i.State.LocalPath); err != nil {
		return fmt.Errorf("while removing symlink: %w", err)
	}

	i.State.LocalPath = ""

	return nil
}

// DisableCommand uninstalls an item and its dependencies, ensuring that no
// sub-item is left in an inconsistent state.
type DisableCommand struct {
	Item  *cwhub.Item
	Force bool
}

func NewDisableCommand(item *cwhub.Item, force bool) *DisableCommand {
	return &DisableCommand{Item: item, Force: force}
}

View on GitHub (pinned to 909b515798)

Solutions

Run the command with sufficient privileges (sudo/root)
Fix permissions/ownership of the config directory
Check whether the config volume is mounted read-only and remount read-write

Example fix

// before
cscli parsers disable my-parser  # permission denied
// after
sudo cscli parsers disable my-parser

Defensive patterns

Strategy: try-catch

Validate before calling

if err := unix.Access(filepath.Dir(item.State.LocalPath), unix.W_OK); err != nil { return fmt.Errorf("dir not writable: %w", err) }

Try / catch

if err := hubops.RemoveInstallLink(item); err != nil {
    if errors.Is(err, fs.ErrPermission) { /* advise sudo */ }
    return err
}

Prevention

Run cscli with the same user that owns the config directory
Avoid read-only mounts for the config directory in containers
Check writability of the config dir before hub mutations

When it happens

Trigger: Calling RemoveInstallLink when the containing directory is read-only or owned by another user, or the filesystem is full/errored.

Common situations: Running cscli as non-root against a root-owned config directory; read-only mounted configuration volume (containers); immutable files.

Understand the failure class

Background: "Permission denied" / "Failed to write" file errors: why a library can't write its files to disk (EACCES, EPERM, ENOSPC) and how to fix them — this error's family across 43 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/cb73732c100164de. Report an issue: GitHub.