{"record":{"id":"7bad1715c4175291","repo":"cloudflare/cloudflared","slug":"chmod-token-file-at-s-w","errorCode":null,"errorMessage":"chmod token file at %s: %w","messagePattern":"chmod token file at (.+?): %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/common_service.go","lineNumber":41,"sourceCode":"\t\t\treturn nil\n\t\t}\n\t\treturn fmt.Errorf(\"create config dir at %s: %w\", configDir, err)\n\t}\n\treturn nil\n}\n\nfunc createTokenFileUnix(path string) error {\n\tconst tokenPerms os.FileMode = 0o600\n\tf, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE, tokenPerms) //nolint:gosec // All callers of this function construct path from constant strings or well-known env vars (e.g., $HOME)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create token file at %s: %w\", path, err)\n\t}\n\tdefer func() { _ = f.Close() }()\n\n\t// If the file already existed with unrestrictive permissions, os.OpenFile\n\t// will not update its permissions, so perform an extra os.Chmod\n\tif err := os.Chmod(path, tokenPerms); err != nil {\n\t\treturn fmt.Errorf(\"chmod token file at %s: %w\", path, err)\n\t}\n\n\treturn nil\n}\n\n// Write out the token file to the configuration directory with the correct\n// permissions. Since the method used to restrict the permissions is platform\n// dependent, make the function used to restrict the permissions an injectable\n// dependency\nfunc writeTokenToFile(path string, token string) error {\n\tif _, err := tunnel.ParseToken(token); err != nil {\n\t\treturn cliutil.UsageError(\"Provided tunnel token is not valid (%s).\", err)\n\t}\n\n\tif err := createTokenFile(path); err != nil {\n\t\treturn fmt.Errorf(\"create token file at %s: %w\", path, err)\n\t}\n","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/common_service.go#L23-L59","documentation":"After opening the token file, createTokenFileUnix calls os.Chmod(path, 0600) because OpenFile will not tighten permissions on a pre-existing file. If the chmod fails, the error is wrapped as 'chmod token file at <path>: <cause>'. Leaving the file with loose permissions would expose the tunnel credential, so this is deliberately fatal.","triggerScenarios":"The token file already exists but is owned by another user (created previously by root), so the current user cannot chmod it; the filesystem does not support chmod; ACLs/immutable attributes block the change.","commonSituations":"First run as root created the token file, later runs as a service user attempt to refresh it; an immutable flag (chattr +i) was set on the credential file; NFS exports squashing ownership.","solutions":["chown the existing token file to the user running cloudflared, or delete it and rerun so it is recreated with 0600","Remove immutable/append-only attributes: `chattr -i <path>`","Run as the same (privileged) user that originally created the file","Avoid sharing the token path across users; give each principal its own cred-file"],"exampleFix":"// before\nsudo cloudflared tunnel token --cred-file /etc/cloudflared/token.json TUNNEL_ID   # file now root-owned\ncloudflared tunnel token --cred-file /etc/cloudflared/token.json TUNNEL_ID        # chmod fails\n// after\nsudo chown $(id -u):$(id -g) /etc/cloudflared/token.json\ncloudflared tunnel token --cred-file /etc/cloudflared/token.json TUNNEL_ID","handlingStrategy":"try-catch","validationCode":"if info, err := os.Stat(path); err == nil && info.Mode().Perm() != 0o600 {\n    if err := os.Chmod(path, 0o600); err != nil {\n        return fmt.Errorf(\"cannot tighten permissions on %s: %w\", path, err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := createTokenFileUnix(path); err != nil {\n    var pathErr *os.PathError\n    if errors.As(err, &pathErr) && errors.Is(pathErr.Err, syscall.EPERM) {\n        return fmt.Errorf(\"cannot chmod %s (owned by someone else?); remove it and rerun as the current user\", path)\n    }\n    return err\n}","preventionTips":["Always create/refresh the token file as the same user that owns it","Avoid root-created credential files consumed by unprivileged services; chown after install","Never set immutable flags on credential files","Verify effective UID matches the file owner before rerunning token commands"],"tags":["filesystem","permissions","chmod"],"backgroundTag":"file-write-permission-denied","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}