From 0c5c16327ddec76f5eb5ef5a266c2690cdd26004 Mon Sep 17 00:00:00 2001
From: Brad Fitzpatrick <bradfitz@tailscale.com>
Date: Wed, 28 Apr 2021 14:57:04 -0700
Subject: [PATCH] version: add IsMacSysExt func

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
---
 version/prop.go | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/version/prop.go b/version/prop.go
index a18080518..1d39ab589 100644
--- a/version/prop.go
+++ b/version/prop.go
@@ -6,8 +6,10 @@ package version
 
 import (
 	"os"
+	"path/filepath"
 	"runtime"
 	"strings"
+	"sync/atomic"
 )
 
 // IsMobile reports whether this is a mobile client build.
@@ -28,12 +30,35 @@ func OS() string {
 }
 
 // IsSandboxedMacOS reports whether this process is a sandboxed macOS
-// (GUI) process. It is true for the Mac App Store and macsys (System
+// process. It is true for the Mac App Store and macsys (System
 // Extension) version on macOS, and false for tailscaled-on-macOS.
 func IsSandboxedMacOS() bool {
 	if runtime.GOOS != "darwin" {
 		return false
 	}
+	if IsMacSysExt() {
+		return true
+	}
 	exe, _ := os.Executable()
 	return strings.HasSuffix(exe, "/Contents/MacOS/Tailscale")
 }
+
+var isMacSysExt atomic.Value
+
+// IsMacSysExt whether this binary is from the standalone "System
+// Extension" (a.k.a. "macsys") version of Tailscale for macOS.
+func IsMacSysExt() bool {
+	if runtime.GOOS != "darwin" {
+		return false
+	}
+	if b, ok := isMacSysExt.Load().(bool); ok {
+		return b
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		return false
+	}
+	v := filepath.Base(exe) == "io.tailscale.ipn.macsys.network-extension"
+	isMacSysExt.Store(v)
+	return v
+}