MGS9002: insecure token file permissions

A magus credential file, the operator token or a record in the token store (tokens.d), has filesystem permissions looser than 0600, so a user other than its owner could read it. Magus refuses to load it rather than trust a world- or group-readable credential. magus doctor also names a state directory other accounts can read.

[MGS9002] auth: token file /path has insecure permissions 0644 (want 0600);
fix with: chmod 600 /path
  see: .../MGS9002.md

Why

These files hold bearer secrets. A secret readable by other accounts on the machine is effectively shared. Magus treats loose permissions as a hard error (not a warning) so a leaked-by-default credential cannot be used silently.

Resolution

Tighten the file to owner-only read/write, exactly as the message says:

chmod 600 <path>

Then re-run the command. If the file lives on a filesystem that cannot represent Unix permissions, move the magus state directory to one that can.

See also

• Tokens and grants: where each token lives.