tailscale/tailscale · error

shutdown access denied by policy

Error message

shutdown access denied by policy

What it means

Shutdown via LocalAPI is blocked by device policy: the policy client reports pkey.AllowTailscaledRestart as false (or unset), so even write-authorized callers cannot restart/stop tailscaled on this node (tailscale/corp#32674).

Source

Thrown at ipn/localapi/localapi.go:1909

type Shutdown struct{}

// serveShutdown shuts down tailscaled. It requires write access
// and the [pkey.AllowTailscaledRestart] policy to be enabled.
// See tailscale/corp#32674.
func (h *Handler) serveShutdown(w http.ResponseWriter, r *http.Request) {
	if r.Method != httpm.POST {
		http.Error(w, "only POST allowed", http.StatusMethodNotAllowed)
		return
	}

	if !h.PermitWrite {
		http.Error(w, "shutdown access denied", http.StatusForbidden)
		return
	}

	polc := h.b.Sys().PolicyClientOrDefault()
	if permitShutdown, _ := polc.GetBoolean(pkey.AllowTailscaledRestart, false); !permitShutdown {
		http.Error(w, "shutdown access denied by policy", http.StatusForbidden)
		return
	}

	ec := h.eventBus.Client("localapi.Handler")
	defer ec.Close()

	w.WriteHeader(http.StatusOK)
	if f, ok := w.(http.Flusher); ok {
		f.Flush()
	}

	eventbus.Publish[Shutdown](ec).Publish(Shutdown{})
}

func (h *Handler) serveServices(w http.ResponseWriter, r *http.Request) {
	if r.Method != httpm.GET {
		http.Error(w, "only GET allowed", http.StatusMethodNotAllowed)
		return

View on GitHub (pinned to 6e0912f979)

Solutions

1. Adjust the tailnet policy to permit shutdown from this node.

When it happens

Trigger: Thrown at ipn/localapi/localapi.go:1909 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/33fbf871d81b2b13. Report an issue: GitHub.