You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/ipn
Andrew Lytvynov 6abb425482
ipn/ipnauth: improve the Windows token administrator check (#10755)
(*Token).IsAdministrator is supposed to return true even when the user is
running with a UAC limited token. The idea is that, for the purposes of
this check, we don't care whether the user is *currently* running with
full Admin rights, we just want to know whether the user can
*potentially* do so.

We accomplish this by querying for the token's "linked token," which
should be the fully-elevated variant, and checking its group memberships.

We also switch ipn/ipnserver/(*Server).connIsLocalAdmin to use the elevation
check to preserve those semantics for tailscale serve; I want the
IsAdministrator check to be used for less sensitive things like toggling
auto-update on and off.

Updates tailscale/corp#15405

Signed-off-by: Aaron Klotz <aaron@tailscale.com>
Co-authored-by: Aaron Klotz <aaron@tailscale.com>
5 months ago
..
ipnauth ipn/ipnauth: improve the Windows token administrator check (#10755) 5 months ago
ipnlocal ipn/localapi: backport require local Windows admin to set serve path (#10744) 5 months ago
ipnserver ipn/ipnauth: improve the Windows token administrator check (#10755) 5 months ago
ipnstate version: detect tvOS by checking XPC_SERVICE_NAME (#8295) 1 year ago
localapi ipn/localapi: backport require local Windows admin to set serve path (#10744) 5 months ago
policy ipn: prefer allow/denylist terminology 1 year ago
store ipn/store/awsstore: persist state with intelligent tiering 1 year ago
backend.go all: update copyright and license headers 1 year ago
doc.go all: update copyright and license headers 1 year ago
fake_test.go all: update copyright and license headers 1 year ago
ipn_clone.go {cmd/tailscale/cli,ipn}: add http support to tailscale serve (#8358) 12 months ago
ipn_view.go {cmd/tailscale/cli,ipn}: add http support to tailscale serve (#8358) 12 months ago
prefs.go all: update copyright and license headers 1 year ago
prefs_test.go all: update copyright and license headers 1 year ago
serve.go ipn/localapi: backport require local Windows admin to set serve path (#10744) 5 months ago
serve_test.go ipn/localapi: backport require local Windows admin to set serve path (#10744) 5 months ago
store.go ipn/store: add support for stores to hook into a custom dialer 1 year ago