You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/ipn/ipnlocal
Maisem Ali 2ae670eb71 ssh/tailssh: work around lack of scontext in SELinux
Trying to SSH when SELinux is enforced results in errors like:

```
➜  ~ ssh ec2-user@<ip>
Last login: Thu Jun  1 22:51:44 from <ip2>
ec2-user: no shell: Permission denied
Connection to <ip> closed.
```

while the `/var/log/audit/audit.log` has
```
type=AVC msg=audit(1685661291.067:465): avc:  denied  { transition } for  pid=5296 comm="login" path="/usr/bin/bash" dev="nvme0n1p1" ino=2564 scontext=system_u:system_r:unconfined_service_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process permissive=0
```

The right fix here would be to somehow install the appropriate context when
tailscale is installed on host, but until we figure out a way to do that
stop using the `login` cmd in these situations.

Updates #4908

Signed-off-by: Maisem Ali <maisem@tailscale.com>
3 years ago
..
testdata ipn/ipnlocal: fix the path for writing cert files (#7203) 3 years ago
c2n.go net/sockstats: expose debug info 3 years ago
cert.go ipn/ipnlocal: renew certificates based on lifetime 3 years ago
cert_js.go all: update copyright and license headers 3 years ago
cert_test.go ipn/ipnlocal: renew certificates based on lifetime 3 years ago
dnsconfig_test.go all: use cmpx.Or where it made sense 3 years ago
expiry.go various: add golangci-lint, fix issues (#7905) 3 years ago
expiry_test.go ci: add more lints (#7909) 3 years ago
local.go ssh/tailssh: work around lack of scontext in SELinux 3 years ago
local_test.go tsd: add package with System type to unify subsystem init, discovery 3 years ago
loglines_test.go tsd: add package with System type to unify subsystem init, discovery 3 years ago
network-lock.go tka: provide verify-deeplink local API endpoint (#8303) 3 years ago
network-lock_test.go various: add golangci-lint, fix issues (#7905) 3 years ago
peerapi.go ipn/ipnlocal,wgengine/netstack: move LocalBackend specifc serving logic to LocalBackend 3 years ago
peerapi_h2c.go all: update copyright and license headers 3 years ago
peerapi_macios_ext.go all: update copyright and license headers 3 years ago
peerapi_test.go ipn/ipnlocal: drop not required StateKey parameter 3 years ago
profiles.go ipn/ipnlocal: add more logging during profile migration 3 years ago
profiles_notwindows.go ipn/ipnlocal, util/winutil/policy: modify Windows profile migration to load legacy prefs from within tailscaled 3 years ago
profiles_test.go ipn/ipnlocal: reenable profile tests on Windows 3 years ago
profiles_windows.go ipn/ipnlocal: add more logging during profile migration 3 years ago
serve.go ipn/ipnlocal: add identity headers to HTTP serve proxy 3 years ago
serve_test.go ipn/ipnlocal: add identity headers to HTTP serve proxy 3 years ago
ssh.go all: update copyright and license headers 3 years ago
ssh_stub.go all: update copyright and license headers 3 years ago
ssh_test.go ipn/ipnlocal: drop not required StateKey parameter 3 years ago
state_test.go tsd: add package with System type to unify subsystem init, discovery 3 years ago