java-native-access/jna · error · IllegalArgumentException

SECURITY_DESCRIPTOR_RELATIVE does not contain owner

Error message

SECURITY_DESCRIPTOR_RELATIVE does not contain owner

What it means

Advapi32Util.setSecurityDescriptorComponents (SECURITY_DESCRIPTOR_RELATIVE path) validates the fields requested for modification before calling SetSecurityDescriptor components. When setOwner is requested but the SECURITY_DESCRIPTOR_RELATIVE structure has no owner SID (psidOwner is null), the library throws IllegalArgumentException rather than passing a null SID to Win32 Advapi32.

Source

Thrown at contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java:2875

                                                      int objectType,
                                                      SECURITY_DESCRIPTOR_RELATIVE securityDescriptor,
                                                      boolean setOwner,
                                                      boolean setGroup,
                                                      boolean setDACL,
                                                      boolean setSACL,
                                                      boolean setDACLProtectedStatus,
                                                      boolean setSACLProtectedStatus) {

        final PSID psidOwner = securityDescriptor.getOwner();
        final PSID psidGroup = securityDescriptor.getGroup();
        final ACL dacl = securityDescriptor.getDiscretionaryACL();
        final ACL sacl = securityDescriptor.getSystemACL();

        int infoType = 0;
        // Parameter validation and infoType flag setting.
        if (setOwner) {
            if (psidOwner == null)
                throw new IllegalArgumentException("SECURITY_DESCRIPTOR_RELATIVE does not contain owner");
            if (!Advapi32.INSTANCE.IsValidSid(psidOwner))
                throw new IllegalArgumentException("Owner PSID is invalid");
            infoType |= OWNER_SECURITY_INFORMATION;
        }

        if (setGroup) {
            if (psidGroup == null)
                throw new IllegalArgumentException("SECURITY_DESCRIPTOR_RELATIVE does not contain group");
            if (!Advapi32.INSTANCE.IsValidSid(psidGroup))
                throw new IllegalArgumentException("Group PSID is invalid");
            infoType |= GROUP_SECURITY_INFORMATION;
        }

        if (setDACL) {
            if (dacl == null)
                throw new IllegalArgumentException("SECURITY_DESCRIPTOR_RELATIVE does not contain DACL");
            if (!Advapi32.INSTANCE.IsValidAcl(dacl.getPointer()))
                throw new IllegalArgumentException("DACL is invalid");

View on GitHub (pinned to d036ad9781)

Solutions

  1. Check psidOwner (or securityDescriptor.getOwner()) for null before requesting owner modification and only set setOwner=true when an owner exists.
  2. Read the owner from the source descriptor via Advapi32Util.getSecurityDescriptorOwner first, or use Advapi32.GetSecurityDescriptorOwner to populate it.
  3. Drop the OWNER_SECURITY_INFORMATION component from the requested info flags so only present components are set.
  4. Construct a complete SECURITY_DESCRIPTOR_RELATIVE including the owner SID before calling the API.

Example fix

// before
Advapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);
// after
if (sd.getOwner() != null) {
    Advapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);
} else {
    Advapi32Util.setSecurityDescriptorComponents(sd, false, true, true, true, false, false);
}
Defensive patterns

Strategy: validation

Validate before calling

if (securityDescriptor.getOwner() == null) {
    throw new IllegalStateException("Descriptor has no owner SID; omit owner component");
}

Type guard

boolean hasOwner(SECURITY_DESCRIPTOR_RELATIVE sd) {
    return sd != null && sd.getOwner() != null;
}

Try / catch

try {
    Advapi32Util.setSecurityDescriptorComponents(sd, setOwner, setGroup, setDACL, setSACL, dacalProtected, sacalProtected);
} catch (IllegalArgumentException e) {
    log.warn("Descriptor component missing/invalid: " + e.getMessage());
}

Prevention

When it happens

Trigger: Calling the method with setOwner=true on a SECURITY_DESCRIPTOR_RELATIVE parsed from a security descriptor that lacks an owner SID (e.g. descriptor control bits indicate no owner, or the buffer was truncated/parsed from a partial descriptor).

Common situations: Building security descriptors manually with only DACL information but requesting owner modification; parsing descriptors returned by APIs that omit owner data; copying SD components between files/registry keys where one side has no owner.

Related errors

AI-assisted analysis of java-native-access/jna@d036ad9781 (2026-09-12). Data as JSON: /api/errors/b890192049c60a51. Report an issue: GitHub.