You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Nick Khyl 551d6ae0f3 ipn, ipn/ipnauth: implement API surface for LocalBackend access checking ... We have a lot of access checks spread around the ipnserver, ipnlocal, localapi, and ipnauth packages, with a significant number of platform-specific checks that are used exclusively on either Windows or Unix-like platforms. Additionally, with the exception of a few Windows-specific checks, most of these checks are per-device rather than per-profile, which is not always correct even on single-user/single-session environments, but even more problematic on multi-user/multi-session environments such as Windows. We initially attempted to map all possible operations onto the permitRead/permitWrite access flags. However, these flags are not utilized on Windows and prove insufficient on Unix machines. Specifically, on Windows, the first user to connect is granted full access, while subsequent logged-in users have no access to the LocalAPI at all. This restriction applies regardless of the environment, local user roles (e.g., whether a Windows user is a local admin), or whether they are the active user on a shared Windows client device. Conversely, on Unix, we introduced the permitCert flag to enable granting non-root web servers (such as www-data, caddy, nginx, etc.) access to certificates. We also added additional access check to distinguish local admins (root on Unix-like platforms, elevated admins on Windows) from users with permitWrite access, and used it as a fix for the serve path LPE. A more fine-grained access control system could better suit our current and future needs, especially in improving the UX across various scenarios on corporate and personal Windows devices. This adds an API surface in ipnauth that will be used in LocalBackend to check access to individual Tailscale profiles as well as any device-wide information and operations. Updates tailscale/corp#18342 Signed-off-by: Nick Khyl <nickk@tailscale.com>		2 months ago
..
childproc	all: update copyright and license headers	1 year ago
debug.go	net/netmon: make ChangeFunc's signature take new ChangeDelta, not bool	10 months ago
depaware.txt	ipn, ipn/ipnauth: implement API surface for LocalBackend access checking	2 months ago
generate.go	cmd/mkmanifest, cmd/tailscale, cmd/tailscaled: remove Windows arm32 resources from OSS	1 year ago
install_darwin.go	all: update copyright and license headers	1 year ago
install_windows.go	all: update copyright and license headers	1 year ago
manifest_windows_386.syso	cmd/{tailscale,tailscaled}: embed manifest into Windows binaries	2 years ago
manifest_windows_amd64.syso	cmd/{tailscale,tailscaled}: embed manifest into Windows binaries	2 years ago
manifest_windows_arm64.syso	cmd/{tailscale,tailscaled}: embed manifest into Windows binaries	2 years ago
proxy.go	all: update copyright and license headers	1 year ago
required_version.go	all: require Go 1.21	10 months ago
sigpipe.go	all: adjust some build tags for plan9	10 months ago
ssh.go	all: update copyright and license headers	1 year ago
taildrop.go	taildrop: remove breaking abstraction layers for apple (#10728)	5 months ago
tailscaled.defaults	cmd/tailscaled: rename relaynode reference in defaults file comment	4 years ago
tailscaled.go	cmd/tailscaled, net/tstun: build for aix/ppc64	2 months ago
tailscaled.openrc	tstest/integration/vms: use an in-process logcatcher (#2360)	3 years ago
tailscaled.service	cmd/tailscaled: move cleanup to an implicit action during startup	2 months ago
tailscaled_bird.go	all: update copyright and license headers	1 year ago
tailscaled_notwindows.go	all: update copyright and license headers	1 year ago
tailscaled_test.go	util/linuxfw: remove yet-unused code to fix linux/arm64 crash	11 months ago
tailscaled_windows.go	tailscale: update tailfs file and package names (#11590)	2 months ago
windows-manifest.xml	cmd/{tailscale,tailscaled}: embed manifest into Windows binaries	2 years ago
with_cli.go	all: update copyright and license headers	1 year ago