You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/ipn
Aaron Klotz fbc18410ad ipn/ipnauth: improve the Windows token administrator check
(*Token).IsAdministrator is supposed to return true even when the user is
running with a UAC limited token. The idea is that, for the purposes of
this check, we don't care whether the user is *currently* running with
full Admin rights, we just want to know whether the user can
*potentially* do so.

We accomplish this by querying for the token's "linked token," which
should be the fully-elevated variant, and checking its group memberships.

We also switch ipn/ipnserver/(*Server).connIsLocalAdmin to use the elevation
check to preserve those semantics for tailscale serve; I want the
IsAdministrator check to be used for less sensitive things like toggling
auto-update on and off.

Fixes #10036

Signed-off-by: Aaron Klotz <aaron@tailscale.com>
2 years ago
..
conffile ipn/{conffile,ipnlocal}: start booting tailscaled from a config file w/ auth key 2 years ago
ipnauth ipn/ipnauth: improve the Windows token administrator check 2 years ago
ipnlocal ipn/ipnlocal: serve web client on quad100 if enabled 2 years ago
ipnserver ipn/ipnauth: improve the Windows token administrator check 2 years ago
ipnstate client/web: restrict full management client behind browser sessions 2 years ago
localapi ipn/localapi: make serveTKASign require write permission (#10094) 2 years ago
policy ipn: prefer allow/denylist terminology 3 years ago
store cmd/k8s-operator,ipn/store/kubestore: patch secrets instead of updating 2 years ago
backend.go cmd/tailscale,ipn/ipnlocal: print debug component names 2 years ago
conf.go ipn: add user pref for running web client 2 years ago
doc.go all: update copyright and license headers 3 years ago
fake_test.go all: update copyright and license headers 3 years ago
ipn_clone.go ipn: introduce app connector advertisement preference and flags 2 years ago
ipn_test.go net/packet: split off checksum munging into different pkg 2 years ago
ipn_view.go ipn: introduce app connector advertisement preference and flags 2 years ago
prefs.go ipn: introduce app connector advertisement preference and flags 2 years ago
prefs_test.go ipn: introduce app connector advertisement preference and flags 2 years ago
serve.go ipn/localapi: require local Windows admin to set serve path (#9969) 2 years ago
serve_test.go ipn/localapi: require local Windows admin to set serve path (#9969) 2 years ago
store.go ipn: avoid useless no-op WriteState calls 2 years ago
store_test.go ipn: avoid useless no-op WriteState calls 2 years ago