You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/cmd
Frederik “Freso” S. Olesen 83fccf9fe5 tailscaled.service: Lock down clock and /dev (#1071)
Research in issue #1063 uncovered why tailscaled would fail with
ProtectClock enabled (it implicitly enabled DevicePolicy=closed).

This knowledge in turn also opens the door for locking down /dev
further, e.g. explicitly setting DevicePolicy=strict (instead of
closed), and making /dev private for the unit.

Additional possible future (or downstream) lockdown that can be done
is setting `PrivateDevices=true` (with `BindPaths=/dev/net/`), however,
systemd 233 or later is required for this, and tailscaled currently need
to work for systemd down to version 215.

Closes https://github.com/tailscale/tailscale/issues/1063

Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com>
4 years ago
..
cloner ipn: use cmd/cloner for Prefs.Clone 4 years ago
derper wgkey: new package 4 years ago
microproxy cmd/microproxy: add -insecure flag 4 years ago
mkpkg cmd/mkpkg: support adding empty directories. 5 years ago
tailscale wgkey: new package 4 years ago
tailscaled tailscaled.service: Lock down clock and /dev (#1071) 4 years ago
tsshd wgengine/monitor: don't call LinkChange when interfaces look unchanged 5 years ago