mirror/tailscale
1
0 Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2026-11-09 02:53:09 -05:00
Code Issues Packages Projects Releases Wiki Activity

release/dist/unixpkgs: set file modes explicitly in deb and rpm packages

Browse Source 
The deb and rpm contents set no mode, so nfpm copied each file's mode
from the source file on disk and the result depended on where the build
ran. Since the release logic moved to OSS in fc4b25d9 (2023-02), corp
builds read the configs and systemd units from the read-only Go module
cache and ship them as 0444, where 1.36 shipped 0644. A checkout with
umask 002 instead gives group-writable 0664 files and 0775 binaries.

Set the modes explicitly, as the tarballs already do: 0755 for the
binaries and 0644 for the systemd units and /etc/default/tailscaled.
Configs return to 0644; binaries are unchanged.

Tested by building the amd64 deb and rpm under umask 002 and 022 and
checking the modes with dpkg-deb -c and rpm -qplv; package metadata is
otherwise unchanged.

Fixes #22202

Change-Id: I14acbd075b2f680720fdec47ce5e4e6033c363f7
Signed-off-by: Gabriel von Winckler <gabriel@tailscale.com>
This commit is contained in:
Gabriel von Winckler committed 2026-11-05 17:00:12 +00:00
1 parent 4dfd5352b9
commit d42b0676ca
1 file changed
+12
Download Patch File Download Diff File Expand all files Collapse all files
release/dist/unixpkgs/pkgs.go
Vendored
+12
View File
@@ -219,31 +219,37 @@ func (t *debTarget) Build(b *dist.Build) ([]string, error) {
Type: files.TypeFile,
Source: ts,
Destination: "/usr/bin/tailscale",
FileInfo: &files.ContentFileInfo{Mode: 0755},
},
&files.Content{
Type: files.TypeFile,
Source: tsd,
Destination: "/usr/sbin/tailscaled",
FileInfo: &files.ContentFileInfo{Mode: 0755},
},
&files.Content{
Type: files.TypeFile,
Source: filepath.Join(tailscaledDir, "tailscaled.service"),
Destination: "/lib/systemd/system/tailscaled.service",
FileInfo: &files.ContentFileInfo{Mode: 0644},
},
&files.Content{
Type: files.TypeFile,
Source: filepath.Join(tailscaledDir, "tailscale-online.target"),
Destination: "/lib/systemd/system/tailscale-online.target",
FileInfo: &files.ContentFileInfo{Mode: 0644},
},
&files.Content{
Type: files.TypeFile,
Source: filepath.Join(tailscaledDir, "tailscale-wait-online.service"),
Destination: "/lib/systemd/system/tailscale-wait-online.service",
FileInfo: &files.ContentFileInfo{Mode: 0644},
},
&files.Content{
Type: files.TypeConfigNoReplace,
Source: filepath.Join(tailscaledDir, "tailscaled.defaults"),
Destination: "/etc/default/tailscaled",
FileInfo: &files.ContentFileInfo{Mode: 0644},
},
}, 0, "deb", false, time.Time{})
if err != nil {
@@ -366,31 +372,37 @@ func (t *rpmTarget) Build(b *dist.Build) ([]string, error) {
Type: files.TypeFile,
Source: ts,
Destination: "/usr/bin/tailscale",
FileInfo: &files.ContentFileInfo{Mode: 0755},
},
&files.Content{
Type: files.TypeFile,
Source: tsd,
Destination: "/usr/sbin/tailscaled",
FileInfo: &files.ContentFileInfo{Mode: 0755},
},
&files.Content{
Type: files.TypeFile,
Source: filepath.Join(tailscaledDir, "tailscaled.service"),
Destination: "/lib/systemd/system/tailscaled.service",
FileInfo: &files.ContentFileInfo{Mode: 0644},
},
&files.Content{
Type: files.TypeFile,
Source: filepath.Join(tailscaledDir, "tailscale-online.target"),
Destination: "/lib/systemd/system/tailscale-online.target",
FileInfo: &files.ContentFileInfo{Mode: 0644},
},
&files.Content{
Type: files.TypeFile,
Source: filepath.Join(tailscaledDir, "tailscale-wait-online.service"),
Destination: "/lib/systemd/system/tailscale-wait-online.service",
FileInfo: &files.ContentFileInfo{Mode: 0644},
},
&files.Content{
Type: files.TypeConfigNoReplace,
Source: filepath.Join(tailscaledDir, "tailscaled.defaults"),
Destination: "/etc/default/tailscaled",
FileInfo: &files.ContentFileInfo{Mode: 0644},
},
// SELinux policy on e.g. CentOS 8 forbids writing to /var/cache.
// Creating an empty directory at install time resolves this issue.