{"record":{"id":"7b2b55db21da7c06","repo":"cloudflare/cloudflared","slug":"create-token-file-at-s-w","errorCode":null,"errorMessage":"create token file at %s: %w","messagePattern":"create token file at (.+?): %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/common_service.go","lineNumber":34,"sourceCode":"const (\n\tdefaultTokenFile = \"token\"\n)\n\nfunc ensureConfigDirExists(configDir string) error {\n\tif err := os.Mkdir(configDir, 0o755); err != nil { //nolint:gosec // config dir must be traversable by non-root user\n\t\tif errors.Is(err, os.ErrExist) {\n\t\t\treturn nil\n\t\t}\n\t\treturn fmt.Errorf(\"create config dir at %s: %w\", configDir, err)\n\t}\n\treturn nil\n}\n\nfunc createTokenFileUnix(path string) error {\n\tconst tokenPerms os.FileMode = 0o600\n\tf, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE, tokenPerms) //nolint:gosec // All callers of this function construct path from constant strings or well-known env vars (e.g., $HOME)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create token file at %s: %w\", path, err)\n\t}\n\tdefer func() { _ = f.Close() }()\n\n\t// If the file already existed with unrestrictive permissions, os.OpenFile\n\t// will not update its permissions, so perform an extra os.Chmod\n\tif err := os.Chmod(path, tokenPerms); err != nil {\n\t\treturn fmt.Errorf(\"chmod token file at %s: %w\", path, err)\n\t}\n\n\treturn nil\n}\n\n// Write out the token file to the configuration directory with the correct\n// permissions. Since the method used to restrict the permissions is platform\n// dependent, make the function used to restrict the permissions an injectable\n// dependency\nfunc writeTokenToFile(path string, token string) error {\n\tif _, err := tunnel.ParseToken(token); err != nil {","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/common_service.go#L16-L52","documentation":"createTokenFileUnix opens (or creates) the token file with os.OpenFile(O_RDWR|O_CREATE, 0600). A failure is wrapped as 'create token file at <path>: <cause>'. This means the token file could not be opened or created, typically due to permissions, a read-only filesystem, or the path being a directory.","triggerScenarios":"The parent directory is not writable by the current user; the path exists as a directory; the filesystem is read-only; SELinux/AppArmor denies the open.","commonSituations":"Writing the token into /etc/cloudflared without sudo; containers with read-only rootfs; a directory was accidentally created at the token file path; disk-full edge cases on create.","solutions":["Run the command with sufficient privileges (sudo) or point --cred-file at a user-writable path","Check that the target path is not an existing directory and remove/rename it","Verify the filesystem is writable (mount flags, disk space)","Check SELinux/AppArmor audit logs if permissions look correct"],"exampleFix":"// before\ncloudflared tunnel token --cred-file /etc/cloudflared/token.json TUNNEL_ID\n// after\nsudo cloudflared tunnel token --cred-file /etc/cloudflared/token.json TUNNEL_ID","handlingStrategy":"try-catch","validationCode":"if info, err := os.Stat(path); err == nil {\n    if info.IsDir() {\n        return fmt.Errorf(\"token path %s is a directory\", path)\n    }\n} else if !os.IsNotExist(err) {\n    return err\n}\nif err := unix.Access(filepath.Dir(path), unix.W_OK); err != nil {\n    return fmt.Errorf(\"cannot write in %s\", filepath.Dir(path))\n}","typeGuard":null,"tryCatchPattern":"if err := createTokenFileUnix(path); err != nil {\n    var pathErr *os.PathError\n    if errors.As(err, &pathErr) && (errors.Is(pathErr.Err, syscall.EACCES) || errors.Is(pathErr.Err, syscall.EPERM)) {\n        return fmt.Errorf(\"permission denied creating %s; try sudo or a writable --cred-file\", path)\n    }\n    return err\n}","preventionTips":["Run the token command with the same user that will read the token later","Keep token paths under directories you own or manage with sudo","Check for a directory already occupying the token file path","Verify mount flags (rw) and free space before writing credentials"],"tags":["filesystem","file-open","permissions"],"backgroundTag":"file-open-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}