What causes "while setting security info: %w" in crowdsecurity/crowdsec?

Ensure the crowdsec service account owns the file: `takeown /f ` then `icacls /grant crowdsec:F`.

while setting security info: %w

Error message

while setting security info: %w

What it means

setFilePerm on Windows failed at the final step: windows.SetNamedSecurityInfo could not write the new (protected) DACL onto the file. The ACL was built successfully but applying it was rejected by the OS, so the file keeps its old permissions.

Source

Thrown at pkg/database/file_utils_windows.go:76

				AccessMode:        windows.GRANT_ACCESS,
				Inheritance:       windows.NO_INHERITANCE,
				Trustee: windows.TRUSTEE{
					MultipleTrusteeOperation: windows.NO_MULTIPLE_TRUSTEE,
					TrusteeForm:              windows.TRUSTEE_IS_SID,
					TrusteeType:              windows.TRUSTEE_IS_GROUP,
					TrusteeValue:             windows.TrusteeValueFromSID(currentGroup),
				},
			},
		}, nil)

	if err != nil {
		return fmt.Errorf("while creating ACL: %w", err)
	}

	err = windows.SetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.DACL_SECURITY_INFORMATION|windows.PROTECTED_DACL_SECURITY_INFORMATION, nil, nil, dacl, nil)

	if err != nil {
		return fmt.Errorf("while setting security info: %w", err)
	}
	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

Ensure the crowdsec service account owns the file: `takeown /f <path>` then `icacls <path> /grant crowdsec:F`.
Run the service under an account with WRITE_DAC on the data directory (LocalSystem or a dedicated account given full control via icacls).
Check no backup/AV process holds the file exclusively; retry after restarting crowdsec.

Defensive patterns

Strategy: try-catch

Validate before calling

// Go (Windows): ensure the current process can write the DACL
// (run icacls check or attempt takeown before calling the API)
cmd := exec.Command("icacls", path)
if out, err := cmd.CombinedOutput(); err != nil {
	log.Warnf("cannot inspect ACLs on %s: %v (%s)", path, err, out)
}

Try / catch

err := setFilePerm(path, 0600)
if err != nil {
	if strings.Contains(err.Error(), "Access is denied") {
		// take ownership or fix service account before retrying
	}
	log.Warnf("setting security info failed: %v", err)
}

Prevention

Run the crowdsec service under the account that owns the data files.
Grant the service account Full control on the data directory via icacls.
Avoid creating DB files as administrator then running the service as another account.

When it happens

Trigger: SetNamedSecurityInfo returning a Win32 error (commonly ERROR_ACCESS_DENIED) when writing DACL_SECURITY_INFORMATION|PROTECTED_DACL_SECURITY_INFORMATION — the running account lacks WRITE_DAC/ownership rights on the file, or the file was locked/removed.

Common situations: CrowdSec service account not owning the DB file (created earlier by an admin or another account); files on volumes where the account lacks WRITE_DAC; backup software holding the file open with exclusive locks.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/18d99c75f1c1a148. Report an issue: GitHub.