Commit Graph

62 Commits (ebaf33a80c5872a2d1156aa3bb55f82f3ce1b97b)

Author SHA1 Message Date
Brad Fitzpatrick 5611f290eb ipn, ipnserver: only require sudo on Linux for mutable CLI actions
This partially reverts d6e9fb1df0, which modified the permissions
on the tailscaled Unix socket and thus required "sudo tailscale" even
for "tailscale status".

Instead, open the permissions back up (on Linux only) but have the
server look at the peer creds and only permit read-only actions unless
you're root.

In the future we'll also have a group that can do mutable actions.

On OpenBSD and FreeBSD, the permissions on the socket remain locked
down to 0600 from d6e9fb1df0.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
4 years ago
Brad Fitzpatrick d6e9fb1df0 all: adjust Unix permissions for those without umasks
Fixes tailscale/corp#1165

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
4 years ago
Brad Fitzpatrick d8e67ca2ab safesocket: gofmt
gofmt differences between versions :(
4 years ago
Brad Fitzpatrick f562c35c0d safesocket: support connecting to Mac TCP server from within App Sandbox 4 years ago
Brad Fitzpatrick 5362e952e1 safesocket: gofmt
Was developed on a random machine without my normal environment.
5 years ago
Brad Fitzpatrick fee2d9fad4 safesocket: connect to the macOS network extension on darwin (as last resort)
(For cmd/tailscale CLI support on macOS)

Signed-off-by: Brad Fitzpatrick <brad@danga.com>
5 years ago
Brad Fitzpatrick b3d9eab1fe safesocket: make some effort to create parent directory of sock 5 years ago
Brad Fitzpatrick 04e6b77774 safesocket: delete incorrect build tag
Leftover from copying one file to another to create safesocket.go
in the earlier documentation change (29f7d64091).
5 years ago
Brad Fitzpatrick 29f7d64091 safesocket: document
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
5 years ago
David Anderson 4460bd638b safesocket: simplify API.
On unix, we want to provide a full path to the desired unix socket.

On windows, currently we want to provide a TCP port, but someday
we'll also provide a "path-ish" object for a named pipe.

For now, simplify the API down to exactly a path and a TCP port.

Signed-off-by: David Anderson <dave@natulte.net>
5 years ago
David Anderson 39bc24cb96 safesocket: make test use testing.T correctly.
Signed-off-by: David Anderson <dave@natulte.net>
5 years ago
Earl Lee a8d8b8719a Move Linux client & common packages into a public repo. 5 years ago