cloudflare/cloudflared · error

get token file DACL: %w

Error message

get token file DACL: %w

What it means

createTokenFile retrieves the discretionary ACL (DACL) from the parsed security descriptor via sd.DACL() so it can be applied to the token file with SetSecurityInformation. If the SECURITY_DESCRIPTOR has no DACL or the Win32 query fails, cloudflared wraps the error with this message. The DACL is what restricts the token file to Administrators and SYSTEM.

Source

Thrown at cmd/cloudflared/windows_service.go:185

		return fmt.Errorf("create token file: %w", err)
	}

	if err := windows.CloseHandle(f); err != nil {
		return fmt.Errorf("close token file: %w", err)
	}

	// As with os.CreateFile / os.OpenFile on Unix, if the file already exists
	// windows.CreateFile will not update the permission information, so we do
	// that explicitly after creating the file.

	owner, _, err := sd.Owner()
	if err != nil {
		return fmt.Errorf("get token file owner: %w", err)
	}

	dacl, _, err := sd.DACL()
	if err != nil {
		return fmt.Errorf("get token file DACL: %w", err)
	}

	// Bitmask indicating which security info we want to set on the file:
	//
	// OWNER_SECURITY_INFORMATION
	//	-> Set file owner
	// DACL_SECURITY_INFORMATION
	// 	-> Set ACEs
	// PROTECTED_DACL_SECURITY_INFORMATION
	//  -> Update DACL to be "protected' such that it cannot inherit entries from its parent
	const securityInfo = windows.OWNER_SECURITY_INFORMATION |
		windows.DACL_SECURITY_INFORMATION |
		windows.PROTECTED_DACL_SECURITY_INFORMATION

	if err := windows.SetNamedSecurityInfo(
		path,
		windows.SE_FILE_OBJECT,
		securityInfo,

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Ensure the SDDL string keeps its 'D:P(A;;FA;;;BA)(A;;FA;;;SY)' DACL section intact
2. Validate custom SDDL with PowerShell ConvertFrom-SddlString before embedding
3. Rebuild/install from an official cloudflared release
4. Retry after freeing memory if the failure was transient (rare allocation failure)

Example fix

// before
const sdString = "O:BA" // DACL section dropped
// after
const sdString = "O:BAD:P(A;;FA;;;BA)(A;;FA;;;SY)" // D:P supplies a protected DACL

# Ensure the SDDL keeps its DACL section
$sddl = 'O:BAD:P(A;;FA;;;BA)(A;;FA;;;SY)'
if (-Not ($sddl -match '^O:[^D]*D:')) { Write-Error 'SDDL missing DACL'; exit 1 }
ConvertFrom-SddlString $sddl | Out-Null

if err := installWindowsService(ctx); err != nil {
	if strings.Contains(err.Error(), "get token file DACL") {
		log.Error().Msg("security descriptor lost its DACL; reinstall an official build")
	}
	return err
}

When it happens

Trigger: sd.DACL() returns an error for the descriptor built from the SDDL string — the descriptor lacks a 'D:' (DACL) section or its ACEs are invalid.

Common situations: A customized sdString that dropped or mangled the 'D:P(...)' portion; tampered/patched cloudflared builds; failure to allocate the ACL during the Win32 call under heavy memory pressure.

Related errors

• create token security descriptor: %w
• get token file owner: %w
• cloudflared service is already installed at ${service}; if y
• Error during update : %s;
• convert path to UTF-16: %w

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/1b0cf3aa1d8fefb1. Report an issue: GitHub.