mirror of https://github.com/tailscale/tailscale/
cmd/tailscale, util/quarantine: set quarantine flags on files from Taildrop
This sets the "com.apple.quarantine" flag on macOS, and the "Zone.Identifier" alternate data stream on Windows. Change-Id: If14f805467b0e2963067937d7f34e08ba1d1fa85 Signed-off-by: Andrew Dunham <andrew@du.nham.ca>pull/6373/head
parent
cec48743fb
commit
0af61f7c40
@ -0,0 +1,15 @@
|
||||
// Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
// Package quarantine sets platform specific "quarantine" attributes on files
|
||||
// that are received from other hosts.
|
||||
package quarantine
|
||||
|
||||
import "os"
|
||||
|
||||
// SetOnFile sets the platform-specific quarantine attribute (if any) on the
|
||||
// provided file.
|
||||
func SetOnFile(f *os.File) error {
|
||||
return setQuarantineAttr(f)
|
||||
}
|
@ -0,0 +1,57 @@
|
||||
// Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package quarantine
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/google/uuid"
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
func setQuarantineAttr(f *os.File) error {
|
||||
sc, err := f.SyscallConn()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
now := time.Now()
|
||||
|
||||
// We uppercase the UUID to match what other applications on macOS do
|
||||
id := strings.ToUpper(uuid.New().String())
|
||||
|
||||
// kLSQuarantineTypeOtherDownload; this matches what AirDrop sets when
|
||||
// receiving a file.
|
||||
quarantineType := "0001"
|
||||
|
||||
// This format is under-documented, but the following links contain a
|
||||
// reasonably comprehensive overview:
|
||||
// https://eclecticlight.co/2020/10/29/quarantine-and-the-quarantine-flag/
|
||||
// https://nixhacker.com/security-protection-in-macos-1/
|
||||
// https://ilostmynotes.blogspot.com/2012/06/gatekeeper-xprotect-and-quarantine.html
|
||||
attrData := fmt.Sprintf("%s;%x;%s;%s",
|
||||
quarantineType, // quarantine value
|
||||
now.Unix(), // time in hex
|
||||
"Tailscale", // application
|
||||
id, // UUID
|
||||
)
|
||||
|
||||
var innerErr error
|
||||
err = sc.Control(func(fd uintptr) {
|
||||
innerErr = unix.Fsetxattr(
|
||||
int(fd),
|
||||
"com.apple.quarantine", // attr
|
||||
[]byte(attrData),
|
||||
0,
|
||||
)
|
||||
})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return innerErr
|
||||
}
|
@ -0,0 +1,15 @@
|
||||
// Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
//go:build !darwin && !windows
|
||||
|
||||
package quarantine
|
||||
|
||||
import (
|
||||
"os"
|
||||
)
|
||||
|
||||
func setQuarantineAttr(f *os.File) error {
|
||||
return nil
|
||||
}
|
@ -0,0 +1,30 @@
|
||||
// Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package quarantine
|
||||
|
||||
import (
|
||||
"os"
|
||||
"strings"
|
||||
)
|
||||
|
||||
func setQuarantineAttr(f *os.File) error {
|
||||
// Documentation on this can be found here:
|
||||
// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/6e3f7352-d11c-4d76-8c39-2516a9df36e8
|
||||
//
|
||||
// Additional information can be found at:
|
||||
// https://www.digital-detective.net/forensic-analysis-of-zone-identifier-stream/
|
||||
// https://bugzilla.mozilla.org/show_bug.cgi?id=1433179
|
||||
content := strings.Join([]string{
|
||||
"[ZoneTransfer]",
|
||||
|
||||
// "URLZONE_INTERNET"
|
||||
// https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537175(v=vs.85)
|
||||
"ZoneId=3",
|
||||
|
||||
// TODO(andrew): should/could we add ReferrerUrl or HostUrl?
|
||||
}, "\r\n")
|
||||
|
||||
return os.WriteFile(f.Name()+":Zone.Identifier", []byte(content), 0)
|
||||
}
|
Loading…
Reference in New Issue