mirror of https://github.com/tailscale/tailscale/
ssh/tailssh: create login sessions for new connections
Signed-off-by: Maisem Ali <maisem@tailscale.com>pull/4116/head
Maisem Ali
2 years ago
committed by
Maisem Ali
parent
ba2c0c3145
commit
06c147d848
@ -0,0 +1,288 @@
|
||||
// Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
// This file contains the code for the incubator process.
|
||||
// Taiscaled launches the incubator as the same user as it was launched as.
|
||||
// The incbuator then registers a new session with the OS, sets its own UID to
|
||||
// the specified `--uid`` and then lauches the requested `--cmd`.
|
||||
|
||||
//go:build linux || (darwin && !ios)
|
||||
// +build linux darwin,!ios
|
||||
|
||||
package tailssh
|
||||
|
||||
import (
|
||||
"context"
|
||||
"flag"
|
||||
"fmt"
|
||||
"io"
|
||||
"log"
|
||||
"log/syslog"
|
||||
"os"
|
||||
"os/exec"
|
||||
"os/user"
|
||||
"runtime"
|
||||
"strings"
|
||||
"syscall"
|
||||
|
||||
"github.com/creack/pty"
|
||||
"github.com/gliderlabs/ssh"
|
||||
"golang.org/x/sys/unix"
|
||||
"tailscale.com/cmd/tailscaled/childproc"
|
||||
"tailscale.com/types/logger"
|
||||
)
|
||||
|
||||
func init() {
|
||||
childproc.Add("ssh", beIncubator)
|
||||
}
|
||||
|
||||
var ptyName = func(f *os.File) (string, error) {
|
||||
return "", fmt.Errorf("unimplemented")
|
||||
}
|
||||
|
||||
// maybeStartLoginSession starts a new login session for the specified UID.
|
||||
// On success, it may return a non-nil close func which must be closed to
|
||||
// release the session.
|
||||
// See maybeStartLoginSessionLinux.
|
||||
var maybeStartLoginSession = func(logf logger.Logf, uid uint32, localUser, remoteUser, remoteHost, tty string) (close func() error, err error) {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
// newIncubatorCommand returns a new exec.Cmd configured with
|
||||
// `tailscaled be-child ssh` as the entrypoint.
|
||||
// If tailscaled is empty, the desired cmd is executed directly.
|
||||
func newIncubatorCommand(ctx context.Context, ci *sshConnInfo, lu *user.User, tailscaled, name string, args []string) *exec.Cmd {
|
||||
if tailscaled == "" {
|
||||
return exec.CommandContext(ctx, name, args...)
|
||||
}
|
||||
remoteUser := ci.uprof.LoginName
|
||||
if len(ci.node.Tags) > 0 {
|
||||
remoteUser = strings.Join(ci.node.Tags, ",")
|
||||
}
|
||||
|
||||
incubatorArgs := []string{
|
||||
"be-child",
|
||||
"ssh",
|
||||
"--uid=" + lu.Uid,
|
||||
"--local-user=" + lu.Name,
|
||||
"--remote-user=" + remoteUser,
|
||||
"--remote-ip=" + ci.src.IP().String(),
|
||||
"--cmd=" + name,
|
||||
}
|
||||
|
||||
if len(args) > 0 {
|
||||
incubatorArgs = append(incubatorArgs, fmt.Sprintf("--cmd-args=%q", strings.Join(args, " ")))
|
||||
}
|
||||
return exec.CommandContext(ctx, tailscaled, incubatorArgs...)
|
||||
}
|
||||
|
||||
const debugIncubator = false
|
||||
|
||||
// beIncubator is the entrypoint to the `tailscaled be-child ssh` subcommand.
|
||||
// It is responsible for informing the system of a new login session for the user.
|
||||
// This is sometimes necessary for mounting home directories and decrypting file
|
||||
// systems.
|
||||
//
|
||||
// Taiscaled launches the incubator as the same user as it was launched as.
|
||||
// The incbuator then registers a new session with the OS, sets its own UID to
|
||||
// the specified `--uid`` and then lauches the requested `--cmd`.
|
||||
func beIncubator(args []string) error {
|
||||
var (
|
||||
flags = flag.NewFlagSet("", flag.ExitOnError)
|
||||
uid = flags.Uint64("uid", 0, "the uid of local-user")
|
||||
localUser = flags.String("local-user", "", "the user to run as")
|
||||
remoteUser = flags.String("remote-user", "", "the remote user/tags")
|
||||
remoteIP = flags.String("remote-ip", "", "the remote Tailscale IP")
|
||||
ttyName = flags.String("tty-name", "", "the tty name (pts/3)")
|
||||
hasTTY = flags.Bool("has-tty", false, "is the output attached to a tty")
|
||||
cmdName = flags.String("cmd", "", "the cmd to launch")
|
||||
cmdArgs = flags.String("cmd-args", "", "the args for cmd")
|
||||
)
|
||||
if err := flags.Parse(args); err != nil {
|
||||
return err
|
||||
}
|
||||
logf := logger.Discard
|
||||
if debugIncubator {
|
||||
// We don't own stdout or stderr, so the only place we can log is syslog.
|
||||
if sl, err := syslog.New(syslog.LOG_INFO|syslog.LOG_DAEMON, "tailscaled-ssh"); err == nil {
|
||||
logf = log.New(sl, "", 0).Printf
|
||||
}
|
||||
}
|
||||
|
||||
euid := uint64(os.Geteuid())
|
||||
// Inform the system that we are about to log someone in.
|
||||
// We can only do this if we are running as root.
|
||||
sessionCloser, err := maybeStartLoginSession(logf, uint32(*uid), *localUser, *remoteUser, *remoteIP, *ttyName)
|
||||
if err == nil && sessionCloser != nil {
|
||||
defer sessionCloser()
|
||||
}
|
||||
if euid != *uid {
|
||||
// Switch users if required before starting the desired process.
|
||||
if err := syscall.Setuid(int(*uid)); err != nil {
|
||||
logf(err.Error())
|
||||
os.Exit(1)
|
||||
}
|
||||
}
|
||||
|
||||
var cArgs []string
|
||||
if *cmdArgs != "" {
|
||||
cArgs = strings.Split(*cmdArgs, " ")
|
||||
}
|
||||
|
||||
cmd := exec.Command(*cmdName, cArgs...)
|
||||
cmd.Stdin = os.Stdin
|
||||
cmd.Stdout = os.Stdout
|
||||
cmd.Stderr = os.Stderr
|
||||
cmd.Env = os.Environ()
|
||||
|
||||
if *hasTTY {
|
||||
// If we were launched with a tty then we should
|
||||
// mark that as the ctty of the child. However,
|
||||
// as the ctty is being passed from the parent
|
||||
// we set the child to foreground instead which
|
||||
// also passes the ctty.
|
||||
// However, we can not do this if never had a tty to
|
||||
// begin with.
|
||||
cmd.SysProcAttr = &syscall.SysProcAttr{
|
||||
Foreground: true,
|
||||
}
|
||||
}
|
||||
return cmd.Run()
|
||||
}
|
||||
|
||||
// launchProcess launches an incubator process for the provided session.
|
||||
// It is responsible for configuring the process execution environment.
|
||||
// The caller can wait for the process to exit by calling cmd.Wait().
|
||||
func (srv *server) launchProcess(ctx context.Context, s ssh.Session, ci *sshConnInfo, lu *user.User) (cmd *exec.Cmd, stdin io.WriteCloser, stdout, stderr io.Reader, err error) {
|
||||
shell := loginShell(lu.Uid)
|
||||
var args []string
|
||||
if rawCmd := s.RawCommand(); rawCmd != "" {
|
||||
args = []string{"-c", rawCmd}
|
||||
}
|
||||
ptyReq, winCh, isPty := s.Pty()
|
||||
|
||||
cmd = newIncubatorCommand(ctx, ci, lu, srv.tailscaledPath, shell, args)
|
||||
cmd.Dir = lu.HomeDir
|
||||
cmd.Env = append(cmd.Env, envForUser(lu)...)
|
||||
cmd.Env = append(cmd.Env, s.Environ()...)
|
||||
cmd.Env = append(cmd.Env,
|
||||
fmt.Sprintf("SSH_CLIENT=%s %d %d", ci.src.IP(), ci.src.Port(), ci.dst.Port()),
|
||||
fmt.Sprintf("SSH_CONNECTION=%s %d %s %d", ci.src.IP(), ci.src.Port(), ci.dst.IP(), ci.dst.Port()),
|
||||
)
|
||||
srv.logf("ssh: starting: %+v", cmd.Args)
|
||||
|
||||
if !isPty {
|
||||
stdin, stdout, stderr, err = startWithStdPipes(cmd)
|
||||
return
|
||||
}
|
||||
pty, err := startWithPTY(cmd, ptyReq)
|
||||
if err != nil {
|
||||
return nil, nil, nil, nil, err
|
||||
}
|
||||
go resizeWindow(pty, winCh)
|
||||
// When using a pty we don't get a separate reader for stderr.
|
||||
return cmd, pty, pty, nil, nil
|
||||
}
|
||||
|
||||
func resizeWindow(f *os.File, winCh <-chan ssh.Window) {
|
||||
for win := range winCh {
|
||||
unix.IoctlSetWinsize(int(f.Fd()), syscall.TIOCSWINSZ, &unix.Winsize{
|
||||
Row: uint16(win.Height),
|
||||
Col: uint16(win.Width),
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// startWithPTY starts cmd with a psuedo-terminal attached to Stdin, Stdout and Stderr.
|
||||
func startWithPTY(cmd *exec.Cmd, ptyReq ssh.Pty) (ptyFile *os.File, err error) {
|
||||
var tty *os.File
|
||||
ptyFile, tty, err = pty.Open()
|
||||
if err != nil {
|
||||
err = fmt.Errorf("pty.Open: %w", err)
|
||||
return
|
||||
}
|
||||
defer func() {
|
||||
if err != nil {
|
||||
ptyFile.Close()
|
||||
tty.Close()
|
||||
}
|
||||
}()
|
||||
if err = pty.Setsize(ptyFile, &pty.Winsize{
|
||||
Rows: uint16(ptyReq.Window.Width),
|
||||
Cols: uint16(ptyReq.Window.Height),
|
||||
}); err != nil {
|
||||
err = fmt.Errorf("pty.Setsize: %w", err)
|
||||
return
|
||||
}
|
||||
cmd.SysProcAttr = &syscall.SysProcAttr{
|
||||
Setctty: true,
|
||||
Setsid: true,
|
||||
}
|
||||
cmd.Args = append(cmd.Args, "--has-tty=true")
|
||||
if ptyName, err := ptyName(ptyFile); err == nil {
|
||||
cmd.Args = append(cmd.Args, "--tty-name="+ptyName)
|
||||
}
|
||||
if ptyReq.Term != "" {
|
||||
cmd.Env = append(cmd.Env, fmt.Sprintf("TERM=%s", ptyReq.Term))
|
||||
}
|
||||
cmd.Stdin = tty
|
||||
cmd.Stdout = tty
|
||||
cmd.Stderr = tty
|
||||
|
||||
if err = cmd.Start(); err != nil {
|
||||
return
|
||||
}
|
||||
return ptyFile, nil
|
||||
}
|
||||
|
||||
// startWithStdPipes starts cmd with os.Pipe for Stdin, Stdout and Stderr.
|
||||
func startWithStdPipes(cmd *exec.Cmd) (stdin io.WriteCloser, stdout, stderr io.ReadCloser, err error) {
|
||||
defer func() {
|
||||
if err != nil {
|
||||
for _, c := range []io.Closer{stdin, stdout, stderr} {
|
||||
if c != nil {
|
||||
c.Close()
|
||||
}
|
||||
}
|
||||
}
|
||||
}()
|
||||
stdin, err = cmd.StdinPipe()
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
stdout, err = cmd.StdoutPipe()
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
stderr, err = cmd.StderrPipe()
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
err = cmd.Start()
|
||||
return
|
||||
}
|
||||
|
||||
func loginShell(uid string) string {
|
||||
switch runtime.GOOS {
|
||||
case "linux":
|
||||
out, _ := exec.Command("getent", "passwd", uid).Output()
|
||||
// out is "root:x:0:0:root:/root:/bin/bash"
|
||||
f := strings.SplitN(string(out), ":", 10)
|
||||
if len(f) > 6 {
|
||||
return strings.TrimSpace(f[6]) // shell
|
||||
}
|
||||
}
|
||||
if e := os.Getenv("SHELL"); e != "" {
|
||||
return e
|
||||
}
|
||||
return "/bin/bash"
|
||||
}
|
||||
|
||||
func envForUser(u *user.User) []string {
|
||||
return []string{
|
||||
fmt.Sprintf("SHELL=" + loginShell(u.Uid)),
|
||||
fmt.Sprintf("USER=" + u.Username),
|
||||
fmt.Sprintf("HOME=" + u.HomeDir),
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,174 @@
|
||||
// Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
//go:build linux
|
||||
// +build linux
|
||||
|
||||
package tailssh
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
"syscall"
|
||||
"time"
|
||||
"unsafe"
|
||||
|
||||
"github.com/godbus/dbus/v5"
|
||||
"tailscale.com/types/logger"
|
||||
)
|
||||
|
||||
func init() {
|
||||
ptyName = ptyNameLinux
|
||||
maybeStartLoginSession = maybeStartLoginSessionLinux
|
||||
}
|
||||
|
||||
func ptyNameLinux(f *os.File) (string, error) {
|
||||
var n uint32
|
||||
_, _, e := syscall.Syscall(syscall.SYS_IOCTL, f.Fd(), syscall.TIOCGPTN, uintptr(unsafe.Pointer(&n)))
|
||||
if e != 0 {
|
||||
return "", e
|
||||
}
|
||||
return fmt.Sprintf("pts/%d", n), nil
|
||||
}
|
||||
|
||||
// callLogin1 invokes the provided method of the "login1" service over D-Bus.
|
||||
// https://www.freedesktop.org/software/systemd/man/org.freedesktop.login1.html
|
||||
func callLogin1(method string, flags dbus.Flags, args ...interface{}) (*dbus.Call, error) {
|
||||
conn, err := dbus.SystemBus()
|
||||
if err != nil {
|
||||
// DBus probably not running.
|
||||
return nil, err
|
||||
}
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), time.Second)
|
||||
defer cancel()
|
||||
|
||||
name, objectPath := "org.freedesktop.login1", "/org/freedesktop/login1"
|
||||
obj := conn.Object(name, dbus.ObjectPath(objectPath))
|
||||
call := obj.CallWithContext(ctx, method, flags, args...)
|
||||
if call.Err != nil {
|
||||
return nil, call.Err
|
||||
}
|
||||
return call, nil
|
||||
}
|
||||
|
||||
// createSessionArgs is a wrapper struct for the Login1.Manager.CreateSession args.
|
||||
// The CreateSession API arguments and response types are defined here:
|
||||
// https://www.freedesktop.org/software/systemd/man/org.freedesktop.login1.html
|
||||
type createSessionArgs struct {
|
||||
uid uint32 // User ID being logged in.
|
||||
pid uint32 // Process ID for the session, 0 means current process.
|
||||
service string // Service creating the session.
|
||||
typ string // Type of login (oneof unspecified, tty, x11).
|
||||
class string // Type of session class (oneof user, greeter, lock-screen).
|
||||
desktop string // the desktop environment.
|
||||
seat string // the seat this session belongs to, empty otherwise.
|
||||
vtnr uint32 // the virtual terminal number of the session if there is any, 0 otherwise.
|
||||
tty string // the kernel TTY path of the session if this is a text login, empty otherwise.
|
||||
display string // the X11 display name if this is a graphical login, empty otherwise.
|
||||
remote bool // whether the session is remote.
|
||||
remoteUser string // the remote user if this is a remote session, empty otherwise.
|
||||
remoteHost string // the remote host if this is a remote session, empty otherwise.
|
||||
properties []struct { // This is unused and exists just to make the marshaling work
|
||||
S string
|
||||
V dbus.Variant
|
||||
}
|
||||
}
|
||||
|
||||
func (a createSessionArgs) args() []interface{} {
|
||||
return []interface{}{
|
||||
a.uid,
|
||||
a.pid,
|
||||
a.service,
|
||||
a.typ,
|
||||
a.class,
|
||||
a.desktop,
|
||||
a.seat,
|
||||
a.vtnr,
|
||||
a.tty,
|
||||
a.display,
|
||||
a.remote,
|
||||
a.remoteUser,
|
||||
a.remoteHost,
|
||||
a.properties,
|
||||
}
|
||||
}
|
||||
|
||||
// createSessionResp is a wrapper struct for the Login1.Manager.CreateSession response.
|
||||
// The CreateSession API arguments and response types are defined here:
|
||||
// https://www.freedesktop.org/software/systemd/man/org.freedesktop.login1.html
|
||||
type createSessionResp struct {
|
||||
sessionID string
|
||||
objectPath dbus.ObjectPath
|
||||
runtimePath string
|
||||
fifoFD dbus.UnixFD
|
||||
uid uint32
|
||||
seatID string
|
||||
vtnr uint32
|
||||
existing bool // whether a new session was created.
|
||||
}
|
||||
|
||||
// createSession creates a tty user login session for the provided uid.
|
||||
func createSession(uid uint32, remoteUser, remoteHost, tty string) (createSessionResp, error) {
|
||||
a := createSessionArgs{
|
||||
uid: uid,
|
||||
service: "tailscaled",
|
||||
typ: "tty",
|
||||
class: "user",
|
||||
tty: tty,
|
||||
remote: true,
|
||||
remoteUser: remoteUser,
|
||||
remoteHost: remoteHost,
|
||||
}
|
||||
|
||||
call, err := callLogin1("org.freedesktop.login1.Manager.CreateSession", 0, a.args()...)
|
||||
if err != nil {
|
||||
return createSessionResp{}, err
|
||||
}
|
||||
|
||||
return createSessionResp{
|
||||
sessionID: call.Body[0].(string),
|
||||
objectPath: call.Body[1].(dbus.ObjectPath),
|
||||
runtimePath: call.Body[2].(string),
|
||||
fifoFD: call.Body[3].(dbus.UnixFD),
|
||||
uid: call.Body[4].(uint32),
|
||||
seatID: call.Body[5].(string),
|
||||
vtnr: call.Body[6].(uint32),
|
||||
existing: call.Body[7].(bool),
|
||||
}, nil
|
||||
}
|
||||
|
||||
// releaseSession releases the session identified by sessionID.
|
||||
func releaseSession(sessionID string) error {
|
||||
// https://www.freedesktop.org/software/systemd/man/org.freedesktop.login1.html
|
||||
_, err := callLogin1("org.freedesktop.login1.Manager.ReleaseSession", dbus.FlagNoReplyExpected, sessionID)
|
||||
return err
|
||||
}
|
||||
|
||||
// maybeStartLoginSessionLinux is the linux implementation of maybeStartLoginSession.
|
||||
func maybeStartLoginSessionLinux(logf logger.Logf, uid uint32, localUser, remoteUser, remoteHost, tty string) (func() error, error) {
|
||||
if os.Geteuid() != 0 {
|
||||
return nil, nil
|
||||
}
|
||||
logf("starting session for user %d", uid)
|
||||
// The only way we can actually start a new session is if we are
|
||||
// running outside one and are root, which is typically the case
|
||||
// for systemd managed tailscaled.
|
||||
resp, err := createSession(uint32(uid), remoteUser, remoteHost, tty)
|
||||
if err != nil {
|
||||
// TODO(maisem): figure out if we are running in a session.
|
||||
// We can look at the DBus GetSessionByPID API.
|
||||
// https://www.freedesktop.org/software/systemd/man/org.freedesktop.login1.html
|
||||
// For now best effort is fine.
|
||||
logf("ssh: failed to CreateSession for user %q (%d) %v", localUser, uid, err)
|
||||
return nil, nil
|
||||
}
|
||||
if !resp.existing {
|
||||
return func() error {
|
||||
return releaseSession(resp.sessionID)
|
||||
}, nil
|
||||
}
|
||||
return nil, nil
|
||||
}
|
||||
Loading…
Reference in New Issue