You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Percy Wegmann 232a2d627c tailfs: only impersonate unprivileged user if able to sudo -u as that user ... When serving TailFS shares, tailscaled executes another tailscaled to act as a file server. It attempts to execute this child process as an unprivileged user using sudo -u. This is important to avoid accessing files as root, which would result in potential privilege escalation. Previously, tailscaled assumed that it was running as someone who can sudo -u, and would fail if it was unable to sudo -u. With this commit, if tailscaled is unable to sudo -u as the requested user, and tailscaled is not running as root, then tailscaled executes the the file server process under the same identity that ran tailscaled, since this is already an unprivileged identity. In the unlikely event that tailscaled is running as root but is unable to sudo -u, it will refuse to run the child file server process in order to avoid privilege escalation. Updates tailscale/corp#16827 Signed-off-by: Percy Wegmann <percy@tailscale.com>		4 months ago
..
compositedav	tailfs: replace webdavfs with reverse proxies	4 months ago
dirfs	tailfs: replace webdavfs with reverse proxies	4 months ago
shared	tailfs: replace webdavfs with reverse proxies	4 months ago
birthtiming.go	tailfs: clean up naming and package structure	4 months ago
birthtiming_test.go	tailfs: clean up naming and package structure	4 months ago
connlistener.go	tailfs: clean up naming and package structure	4 months ago
connlistener_test.go	tailfs: clean up naming and package structure	4 months ago
fileserver.go	tailfs: clean up naming and package structure	4 months ago
local_impl.go	tailfs: replace webdavfs with reverse proxies	4 months ago
remote_impl.go	tailfs: only impersonate unprivileged user if able to sudo -u as that user	4 months ago
tailfs_test.go	tailfs: fix race condition in tailfs_test	4 months ago