What causes "get token file DACL: %w" in cloudflare/cloudflared?

Ensure the SDDL string keeps its 'D:P(A;;FA;;;BA)(A;;FA;;;SY)' DACL section intact

get token file DACL

Error message

get token file DACL: %w

What it means

createTokenFile retrieves the discretionary ACL (DACL) from the parsed security descriptor via sd.DACL() so it can be applied to the token file with SetSecurityInformation. If the SECURITY_DESCRIPTOR has no DACL or the Win32 query fails, cloudflared wraps the error with this message. The DACL is what restricts the token file to Administrators and SYSTEM.

Solutions

Ensure the SDDL string keeps its 'D:P(A;;FA;;;BA)(A;;FA;;;SY)' DACL section intact
Validate custom SDDL with PowerShell ConvertFrom-SddlString before embedding
Rebuild/install from an official cloudflared release
Retry after freeing memory if the failure was transient (rare allocation failure)

Example fix

// before
const sdString = "O:BA" // DACL section dropped
// after
const sdString = "O:BAD:P(A;;FA;;;BA)(A;;FA;;;SY)" // D:P supplies a protected DACL

Defensive patterns

Strategy: try-catch

Validate before calling

# Ensure the SDDL keeps its DACL section
$sddl = 'O:BAD:P(A;;FA;;;BA)(A;;FA;;;SY)'
if (-Not ($sddl -match '^O:[^D]*D:')) { Write-Error 'SDDL missing DACL'; exit 1 }
ConvertFrom-SddlString $sddl | Out-Null

Try / catch

if err := installWindowsService(ctx); err != nil {
	if strings.Contains(err.Error(), "get token file DACL") {
		log.Error().Msg("security descriptor lost its DACL; reinstall an official build")
	}
	return err
}

Prevention

Keep the 'D:P(...)' DACL section intact in the SDDL string
Validate custom SDDL with ConvertFrom-SddlString
Install official builds; retry if the failure was a transient allocation error

When it happens

Trigger: sd.DACL() returns an error for the descriptor built from the SDDL string — the descriptor lacks a 'D:' (DACL) section or its ACEs are invalid.

Common situations: A customized sdString that dropped or mangled the 'D:P(...)' portion; tampered/patched cloudflared builds; failure to allocate the ACL during the Win32 call under heavy memory pressure.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/1b0cf3aa1d8fefb1. Report an issue: GitHub.

Appendix: source

Thrown at cmd/cloudflared/windows_service.go:185

		return fmt.Errorf("create token file: %w", err)
	}

	if err := windows.CloseHandle(f); err != nil {
		return fmt.Errorf("close token file: %w", err)
	}

	// As with os.CreateFile / os.OpenFile on Unix, if the file already exists
	// windows.CreateFile will not update the permission information, so we do
	// that explicitly after creating the file.

	owner, _, err := sd.Owner()
	if err != nil {
		return fmt.Errorf("get token file owner: %w", err)
	}

	dacl, _, err := sd.DACL()
	if err != nil {
		return fmt.Errorf("get token file DACL: %w", err)
	}

	// Bitmask indicating which security info we want to set on the file:
	//
	// OWNER_SECURITY_INFORMATION
	//	-> Set file owner
	// DACL_SECURITY_INFORMATION
	// 	-> Set ACEs
	// PROTECTED_DACL_SECURITY_INFORMATION
	//  -> Update DACL to be "protected' such that it cannot inherit entries from its parent
	const securityInfo = windows.OWNER_SECURITY_INFORMATION |
		windows.DACL_SECURITY_INFORMATION |
		windows.PROTECTED_DACL_SECURITY_INFORMATION

	if err := windows.SetNamedSecurityInfo(
		path,
		windows.SE_FILE_OBJECT,
		securityInfo,

View on GitHub (pinned to 2253eeeb25)