You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/safesocket
Jonathan Nobels 1bf4c6481a
safesocket: add ability for Darwin clients to set explicit credentials (#14702)
updates tailscale/corp#25687

The darwin appstore and standalone clients now support XPC and the keychain for passing user credentials securely between the gui process and an NEVPNExtension hosted tailscaled. Clients that can communicate directly with the network extension, via XPC or the keychain, are now expected to call SetCredentials and supply credentials explicitly, fixing issues with the cli breaking if the current user cannot read the contents of /Library/Tailscale due to group membership restrictions. This matches how those clients source and supply credentials to the localAPI http client.

Non-platform-specific code that has traditionally been in the client is moved to safesocket.

/Libraray/Tailscaled/sameuserproof has its permissions changed to that it's readably only by users in the admin group. This restricts standalone CLI access for and direct use of localAPI to admins.

Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
10 months ago
..
basic_test.go safesocket: add ConnectContext 2 years ago
pipe_windows.go safesocket: add ConnectContext 2 years ago
pipe_windows_test.go all: use Go 1.22 range-over-int 2 years ago
safesocket.go safesocket: add ConnectContext 2 years ago
safesocket_darwin.go safesocket: add ability for Darwin clients to set explicit credentials (#14702) 10 months ago
safesocket_darwin_test.go safesocket: add ability for Darwin clients to set explicit credentials (#14702) 10 months ago
safesocket_js.go safesocket: add ConnectContext 2 years ago
safesocket_plan9.go safesocket: add ConnectContext 2 years ago
safesocket_ps.go safesocket: don't depend on go-ps on iOS 1 year ago
safesocket_test.go all: update copyright and license headers 3 years ago
unixsocket.go all: fix new lint warnings from bumping staticcheck 1 year ago
zsyscall_windows.go ipn, safesocket: use Windows token in LocalAPI 2 years ago