{"record":{"id":"8f38a0b437115e27","repo":"cloudflare/cloudflared","slug":"create-token-security-descriptor-w","errorCode":null,"errorMessage":"create token security descriptor: %w","messagePattern":"create token security descriptor: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/windows_service.go","lineNumber":144,"sourceCode":"\t// - O:BA         -> Set the owner to the builtin administrators group (BA)\n\t// - D:           -> Start of discretionary access control list describing access rights\n\t// - P            -> Set the SE_DACL_PROTECTED flag, which prevents the file from\n\t//                   inheriting the (usually permissive) ACEs from its parent directory\n\t// - (A;;FA;;;BA) -> ACE #1: Allow (A) Full access (FA) to the Builtin Administrators group (BA)\n\t// - (A;;FA;;;SY) -> ACE #2: Ditto but for the Local System user (SY)\n\t//\n\t// Relevant Docs:\n\t//\n\t// - SecurityDescriptor string as a whole:\n\t//     https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-string-format\n\t// - SID Strings such as BA/SY\n\t//     https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings\n\t// - ACE Strings such as (A;;FA;;BA)\n\t//     https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings\n\tconst sdString = \"O:BAD:P(A;;FA;;;BA)(A;;FA;;;SY)\"\n\tsd, err := windows.SecurityDescriptorFromString(sdString)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create token security descriptor: %w\", err)\n\t}\n\n\tpathRaw, err := windows.UTF16PtrFromString(path)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"convert path to UTF-16: %w\", err)\n\t}\n\n\tf, err := windows.CreateFile(\n\t\tpathRaw,\n\t\twindows.GENERIC_WRITE,\n\t\t0,\n\t\t&windows.SecurityAttributes{\n\t\t\tLength:             uint32(unsafe.Sizeof(windows.SecurityAttributes{})),\n\t\t\tSecurityDescriptor: sd,\n\t\t\tInheritHandle:      0,\n\t\t},\n\t\twindows.CREATE_ALWAYS, // Will truncate the file if it exists\n\t\twindows.FILE_ATTRIBUTE_NORMAL,","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/windows_service.go#L126-L162","documentation":"createTokenFile builds the access-token file used by the installed Windows service and first converts a hard-coded SDDL string ('O:BAD:P(A;;FA;;;BA)(A;;FA;;;SY)', granting file access only to Administrators and SYSTEM) into a SECURITY_DESCRIPTOR. windows.SecurityDescriptorFromString fails if the SDDL string cannot be parsed. With the current constant this is practically unreachable, but any malformed SDDL input surfaces here wrapped with this message.","triggerScenarios":"windows.SecurityDescriptorFromString returns a Win32 error for the sdString constant — a parse failure of the security descriptor string.","commonSituations":"Modifying the hard-coded SDDL string and introducing a typo or an invalid SID/ACE; running on a Windows build whose SDDL parser rejects a component; corrupted golang.org/x/sys/windows build.","solutions":["Do not edit the sdString constant unless you validate the SDDL with a Windows tool first","Verify the string parses with PowerShell: ConvertFrom-SddlString 'O:BAD:P(A;;FA;;;BA)(A;;FA;;;SY)'","Rebuild cloudflared from a clean checkout to rule out a tampered source constant","Run `cloudflared service install` on a stock build and file an issue if it still fails"],"exampleFix":"// before\nconst sdString = \"O:BAD:P(A;;FA;;;BA)(A;;FA;;;SY\"\nsd, err := windows.SecurityDescriptorFromString(sdString)\n// after\nconst sdString = \"O:BAD:P(A;;FA;;;BA)(A;;FA;;;SY)\" // balanced parens, valid ACEs\nsd, err := windows.SecurityDescriptorFromString(sdString)\nif err != nil {\n\treturn fmt.Errorf(\"create token security descriptor: %w\", err)\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// caller of service install\nif err := installWindowsService(ctx); err != nil {\n\tvar sdErr error\n\tif errors.Unwrap(err) != nil && strings.Contains(err.Error(), \"security descriptor\") {\n\t\tsdErr = err // SDDL parse issue: report build/version and file a bug\n\t}\n\treturn err\n}","preventionTips":["Do not modify the hard-coded sdString constant","Validate any custom SDDL with ConvertFrom-SddlString first","Install only official cloudflared builds","Keep cloudflared updated so windows-package fixes are included"],"tags":["windows","sddl","security-descriptor"],"backgroundTag":"invalid-security-descriptor","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}