java-native-access/jna · error · IllegalArgumentException

SECURITY_DESCRIPTOR_RELATIVE does not contain group

Error message

SECURITY_DESCRIPTOR_RELATIVE does not contain group

What it means

The mirror of error 121 for the group component: when setGroup is requested but the SECURITY_DESCRIPTOR_RELATIVE contains no group SID (psidGroup is null), Advapi32Util throws IllegalArgumentException before issuing the Win32 call.

Source

Thrown at contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java:2883

        final PSID psidOwner = securityDescriptor.getOwner();
        final PSID psidGroup = securityDescriptor.getGroup();
        final ACL dacl = securityDescriptor.getDiscretionaryACL();
        final ACL sacl = securityDescriptor.getSystemACL();

        int infoType = 0;
        // Parameter validation and infoType flag setting.
        if (setOwner) {
            if (psidOwner == null)
                throw new IllegalArgumentException("SECURITY_DESCRIPTOR_RELATIVE does not contain owner");
            if (!Advapi32.INSTANCE.IsValidSid(psidOwner))
                throw new IllegalArgumentException("Owner PSID is invalid");
            infoType |= OWNER_SECURITY_INFORMATION;
        }

        if (setGroup) {
            if (psidGroup == null)
                throw new IllegalArgumentException("SECURITY_DESCRIPTOR_RELATIVE does not contain group");
            if (!Advapi32.INSTANCE.IsValidSid(psidGroup))
                throw new IllegalArgumentException("Group PSID is invalid");
            infoType |= GROUP_SECURITY_INFORMATION;
        }

        if (setDACL) {
            if (dacl == null)
                throw new IllegalArgumentException("SECURITY_DESCRIPTOR_RELATIVE does not contain DACL");
            if (!Advapi32.INSTANCE.IsValidAcl(dacl.getPointer()))
                throw new IllegalArgumentException("DACL is invalid");
            infoType |= DACL_SECURITY_INFORMATION;
        }

        if (setSACL) {
            if (sacl == null)
                throw new IllegalArgumentException("SECURITY_DESCRIPTOR_RELATIVE does not contain SACL");
            if (!Advapi32.INSTANCE.IsValidAcl(sacl.getPointer()))
                throw new IllegalArgumentException("SACL is invalid");

View on GitHub (pinned to d036ad9781)

Solutions

  1. Check securityDescriptor.getGroup() for null before requesting group modification; set setGroup=false when absent.
  2. Populate the group SID via Advapi32.GetSecurityDescriptorGroup or by re-parsing a complete descriptor.
  3. Remove GROUP_SECURITY_INFORMATION from the requested components so only present parts are applied.
  4. Build the SECURITY_DESCRIPTOR_RELATIVE with all required components before calling the API.

Example fix

// before
Advapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);
// after
Advapi32Util.setSecurityDescriptorComponents(sd, true, sd.getGroup() != null, true, true, false, false);
Defensive patterns

Strategy: validation

Validate before calling

if (securityDescriptor.getGroup() == null) {
    throw new IllegalStateException("Descriptor has no group SID; omit group component");
}

Type guard

boolean hasGroup(SECURITY_DESCRIPTOR_RELATIVE sd) {
    return sd != null && sd.getGroup() != null;
}

Try / catch

try {
    Advapi32Util.setSecurityDescriptorComponents(sd, setOwner, setGroup, setDACL, setSACL, false, false);
} catch (IllegalArgumentException e) {
    log.warn("Descriptor component missing/invalid: " + e.getMessage());
}

Prevention

When it happens

Trigger: Calling the method with setGroup=true on a descriptor whose group SID was never set or was not parsed (control bits indicate no group, or the source descriptor omitted it).

Common situations: Descriptors created with SE_GROUP_* bits absent; copying only owner/DACL data between objects; parsing a partially populated SECURITY_DESCRIPTOR_RELATIVE from a registry key or file.

Related errors

AI-assisted analysis of java-native-access/jna@d036ad9781 (2026-09-12). Data as JSON: /api/errors/96575c47cb1ffb6a. Report an issue: GitHub.