tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	2c447de6cc	cmd/tailscaled: use explicit equal sign in --port=$PORT in tailscaled.service Personal preference (so it's obvious it's not a bool flag), but it also matches the --state= before it. Bonus: stop allowing PORT to sneak in extra flags to be passed as their own arguments, as $FOO and ${FOO} expand differently. (${FOO} is required to concat to strings) Change-Id: I994626a5663fe0948116b46a971e5eb2c4023216 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	56d8c2da34	cmd/tailscaled: set StateDirectoryMode=0700 in tailscaled.service Updates #2934 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	ac07ff43bf	cmd/tailscaled: start after NetworkManager and systemd-resolved. The dependency is a "soft" ordering dependency only, meaning that tailscaled will start after those services if those services were going to be run anyway, but doesn't force either of them to run. That's why it's safe to specify this dependency unconditionally, even for systems that don't run those services. Updates #2127. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	2889fabaef	cmd/tailscaled/tailscaled.service: revert recent hardening for now It broke Debian Stretch. We'll try again later. Updates #1245 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	de497358b8	cmd/tailscaled: add /run to the allowed paths for iptables. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Frederik “Freso” S. Olesen	83fccf9fe5	tailscaled.service: Lock down clock and /dev (#1071 ) Research in issue #1063 uncovered why tailscaled would fail with ProtectClock enabled (it implicitly enabled DevicePolicy=closed). This knowledge in turn also opens the door for locking down /dev further, e.g. explicitly setting DevicePolicy=strict (instead of closed), and making /dev private for the unit. Additional possible future (or downstream) lockdown that can be done is setting `PrivateDevices=true` (with `BindPaths=/dev/net/`), however, systemd 233 or later is required for this, and tailscaled currently need to work for systemd down to version 215. Closes https://github.com/tailscale/tailscale/issues/1063 Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com>	3 years ago
Frederik “Freso” S. Olesen	a9a80ab372	tailscaled.service: Harden systemd unit somewhat (#1062 ) While not a full capability lockdown of the systemd unit, this still improves sandboxing and security of the running process a good deal. Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com>	3 years ago
Christine Dodrill	7ea809897d	ipn/ipnserver: enable systemd-notify support Addresses #964 Still to be done: - Figure out the correct logging lines in util/systemd - Figure out if we need to slip the systemd.Status function anywhere else - Log util/systemd errors? (most of the errors are of the "you cannot do anything about this, but it might be a bad idea to crash the program if it errors" kind) Assistance in getting this over the finish line would help a lot. Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: rename the nonlinux file to appease the magic Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix package name Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix review feedback from @mdlayher Signed-off-by: Christine Dodrill <me@christine.website> cmd/tailscale{,d}: update depaware manifests Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: use sync.Once instead of func init Signed-off-by: Christine Dodrill <me@christine.website> control/controlclient: minor review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> {control,ipn,systemd}: fix review feedback Signed-off-by: Christine Dodrill <me@christine.website> review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> ipn: fix sprintf call Signed-off-by: Christine Dodrill <me@christine.website> ipn: make staticcheck less sad Signed-off-by: Christine Dodrill <me@christine.website> ipn: print IP address in connected status Signed-off-by: Christine Dodrill <me@christine.website> ipn: review feedback Signed-off-by: Christine Dodrill <me@christine.website> final fixups Signed-off-by: Christine Dodrill <me@christine.website>	4 years ago
David Anderson	7988f75b87	tailscaled.service: also cleanup prior to starting. Fixes #813. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Crawshaw	92e9a5ac15	tailscaled.service: use default restart limiting It appears that systemd has sensible defaults for limiting crash loops: DefaultStartLimitIntervalSec=10s DefaultStartLimitBurst=5 Remove our insta-restart configuration so that it works. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	4 years ago
Dmytro Shynkevych	61abab999e	cmd/tailscaled: graceful shutdown (#534 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
David Anderson	362d6af4e2	cmd/tailscaled: set CacheDirectory in service. Signed-off-by: David Anderson <dave@natulte.net>	4 years ago
David Anderson	ea0836dce9	cmd/tailscaled: remove default user/group from systemd.	4 years ago
David Anderson	c4f6f622f0	tailscaled: remove comment from systemd unit. No need to ship TODOs to end user systems. Signed-off-by: David Anderson <dave@natulte.net>	4 years ago
David Anderson	20e6fc1d78	tailscaled: fix systemd unit definition. Port number has to be by itself for substitution to work. Disabling the restart rate-limiting has to be in [Unit] not [Service]. Signed-off-by: David Anderson <dave@natulte.net>	4 years ago
David Anderson	5d4b96b8f2	tailscaled: add a systemd unit. Signed-off-by: David Anderson <dave@natulte.net>	4 years ago

16 Commits (be107f92d349d19d5b5f461ec3aa10ef6b551ffe)